Security incidents tagged Cloudflare. Newest first.
FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.
HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)Since Oct 20, 2026
Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.
Salesloft Drift integration (Salesforce, Google Workspace)Closed Sep 7, 2025
polyfill.io CDN Patched
The polyfill.io domain and GitHub account were bought in February 2024 by a Chinese company. The CDN, embedded via cdn.polyfill.io on more than 100,000 sites, then served malicious JavaScript that redirected some mobile visitors to a sports betting site. Sansec exposed it on 2024-06-25. Cloudflare began rewriting polyfill.io links to its own mirror, and Namecheap put the domain on hold.
Cloudflare internal Atlassian environment No fix needed
A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.
An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.
Okta Help Center (customer support system)Closed Nov 29, 2023
Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.
HTTP/2 protocol implementations (servers, proxies, CDNs)Closed Oct 10, 2023
HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now. #HTTP3 #QPACK #Vulnerability t.co/ZU7h7ky0XX
HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃"Header Accordions"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 t.co/iIRxIHmhnu
QUICの多くの実装でのOOM "Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation" t.co/qEjI9cftas
