{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:38:01.102Z",
  "tag": {
    "id": "cloudflare",
    "label": "Cloudflare",
    "isStack": false,
    "url": "https://pwn.watch/t/cloudflare",
    "feed": "https://pwn.watch/t/cloudflare/feed.xml"
  },
  "counts": {
    "incidents": 6,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 5
  },
  "incidents": [
    {
      "slug": "http3-qpack-header-accordions",
      "title": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "url": "https://pwn.watch/i/http3-qpack-header-accordions",
      "json": "https://pwn.watch/i/http3-qpack-header-accordions.json",
      "status": "live",
      "severity": "unknown",
      "patchStatus": "partial",
      "product": "HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)",
      "tags": [
        "go",
        "rust",
        "python",
        "cloudflare",
        "http3"
      ],
      "cveIds": [
        "CVE-2025-64702",
        "CVE-2026-12523",
        "CVE-2025-13945"
      ],
      "affectedVersions": [
        "See FoxIO table; Bun 1.4.3 and aioquic/mitmproxy unpatched as of Oct 20 2026"
      ],
      "fixedVersions": [
        "quic-go 0.57.0",
        "Cloudflare quiche 0.29.3",
        "lsquic 4.9.0",
        "Wireshark 4.6.2 / 4.4.12"
      ],
      "startedAt": "2026-10-20",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:19:00+02:00",
      "summary": "FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.",
      "xPost": null
    },
    {
      "slug": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "title": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025",
      "json": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Salesloft Drift integration (Salesforce, Google Workspace)",
      "tags": [
        "salesloft",
        "drift",
        "salesforce",
        "oauth",
        "cloudflare",
        "data-breach",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Organizations with Drift connected to Salesforce or other apps"
      ],
      "fixedVersions": [
        "Drift tokens revoked; rotate any secrets stored in Salesforce"
      ],
      "startedAt": "2025-08-08",
      "closedAt": "2025-09-07",
      "updatedAt": "2025-09-07",
      "summary": "Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.",
      "xPost": null
    },
    {
      "slug": "polyfill-io-supply-chain-attack",
      "title": "polyfill.io CDN turned malicious on 100k+ sites",
      "url": "https://pwn.watch/i/polyfill-io-supply-chain-attack",
      "json": "https://pwn.watch/i/polyfill-io-supply-chain-attack.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "polyfill.io CDN",
      "tags": [
        "polyfill",
        "javascript",
        "cdn",
        "supply-chain",
        "cloudflare"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Any site loading scripts from cdn.polyfill.io"
      ],
      "fixedVersions": [
        "Remove polyfill.io references or switch to the Cloudflare/Fastly mirrors"
      ],
      "startedAt": "2024-06-25",
      "closedAt": "2024-06-27",
      "updatedAt": "2024-06-27",
      "summary": "The polyfill.io domain and GitHub account were bought in February 2024 by a Chinese company. The CDN, embedded via cdn.polyfill.io on more than 100,000 sites, then served malicious JavaScript that redirected some mobile visitors to a sports betting site. Sansec exposed it on 2024-06-25. Cloudflare began rewriting polyfill.io links to its own mirror, and Namecheap put the domain on hold.",
      "xPost": null
    },
    {
      "slug": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "title": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion",
      "json": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Cloudflare internal Atlassian environment",
      "tags": [
        "cloudflare",
        "okta",
        "atlassian",
        "confluence",
        "secrets"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-11-14",
      "closedAt": "2024-02-01",
      "updatedAt": "2024-02-01",
      "summary": "A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.",
      "xPost": null
    },
    {
      "slug": "okta-support-system-breach-2023",
      "title": "Okta support system breach: HAR files with session tokens stolen",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023",
      "json": "https://pwn.watch/i/okta-support-system-breach-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Okta Help Center (customer support system)",
      "tags": [
        "okta",
        "beyondtrust",
        "cloudflare",
        "1password",
        "identity",
        "session-hijacking",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-09-28",
      "closedAt": "2023-11-29",
      "updatedAt": "2023-11-29",
      "summary": "An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.",
      "xPost": null
    },
    {
      "slug": "http2-rapid-reset-ddos-cve-2023-44487",
      "title": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487",
      "json": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "HTTP/2 protocol implementations (servers, proxies, CDNs)",
      "tags": [
        "node",
        "go",
        "java",
        "dotnet",
        "http2",
        "ddos",
        "cloudflare",
        "google",
        "aws",
        "nginx",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-44487"
      ],
      "affectedVersions": [
        "Most HTTP/2 implementations; see each vendor's advisory"
      ],
      "fixedVersions": [
        "See vendor advisories (each HTTP/2 implementation shipped its own fix)"
      ],
      "startedAt": "2023-08-25",
      "closedAt": "2023-10-10",
      "updatedAt": "2023-10-10",
      "summary": "Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "The Daily Tech Feed",
      "handle": "dailytechonx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1889684200258764800/AEZLG4yL_bigger.jpg",
      "text": "HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now.\n\n#HTTP3 #QPACK #Vulnerability https://t.co/ZU7h7ky0XX",
      "date": "2026-10-22T07:02:21.000Z",
      "url": "https://x.com/dailytechonx/status/2113164033914175882",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVN3faQWgAIF_bP.jpg"
        }
      ],
      "incident": "http3-qpack-header-accordions"
    },
    {
      "authorName": "kokumօtօ",
      "handle": "__kokumoto",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1612504196720492544/T_-s-6OP_bigger.jpg",
      "text": "HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃\"Header Accordions\"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 https://t.co/iIRxIHmhnu",
      "date": "2026-10-22T03:32:49.000Z",
      "url": "https://x.com/__kokumoto/status/2113111305393750474",
      "media": [],
      "incident": "http3-qpack-header-accordions"
    },
    {
      "authorName": "azu",
      "handle": "azu_re",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1081057521719078912/OqWfdeQ6_bigger.jpg",
      "text": "QUICの多くの実装でのOOM \"Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation\" https://t.co/qEjI9cftas",
      "date": "2026-10-21T23:49:44.000Z",
      "url": "https://x.com/azu_re/status/2113055165100286299",
      "media": [],
      "incident": "http3-qpack-header-accordions"
    }
  ],
  "changes": [
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "FoxIO blog + PoC published; several stacks still unpatched.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    },
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2025-11 → 2026-07",
      "title": "Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    },
    {
      "incident": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-09-02",
      "title": "Cloudflare details the impact on its Salesforce case data",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/response-to-salesloft-drift-incident/",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025"
    },
    {
      "incident": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-08-26",
      "title": "Google Threat Intelligence publishes UNC6395 findings",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025"
    },
    {
      "incident": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-08-20",
      "title": "Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025"
    },
    {
      "incident": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-08-08",
      "title": "Data theft from Salesforce instances begins (through Aug 18)",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025"
    },
    {
      "incident": "polyfill-io-supply-chain-attack",
      "incidentTitle": "polyfill.io CDN turned malicious on 100k+ sites",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-27",
      "title": "Cloudflare rewrites cdn.polyfill.io to its mirror; Namecheap puts the domain on hold",
      "body": null,
      "sourceUrl": "https://sansec.io/research/polyfill-supply-chain-attack",
      "url": "https://pwn.watch/i/polyfill-io-supply-chain-attack"
    },
    {
      "incident": "polyfill-io-supply-chain-attack",
      "incidentTitle": "polyfill.io CDN turned malicious on 100k+ sites",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-25",
      "title": "Sansec reports the polyfill.io supply-chain attack hitting 100k+ sites",
      "body": null,
      "sourceUrl": "https://sansec.io/research/polyfill-supply-chain-attack",
      "url": "https://pwn.watch/i/polyfill-io-supply-chain-attack"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-02-01",
      "title": "Cloudflare publishes its full write-up",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-29",
      "title": "Okta: the attacker downloaded the names and email addresses of all customer support system users",
      "body": null,
      "sourceUrl": "https://sec.okta.com/articles/october-security-incident-recommended-actions/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-23",
      "title": "Cloudflare detects the attacker on its self-hosted Atlassian server",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-14",
      "title": "Attacker begins reconnaissance with credentials from the Okta compromise",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-03",
      "title": "Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked",
      "body": null,
      "sourceUrl": "https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-19",
      "title": "Okta notifies customers of the security incident",
      "body": null,
      "sourceUrl": "https://sec.okta.com/harfiles",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-18",
      "title": "Cloudflare detects attackers pivoting into its Okta instance with a token stolen from Okta",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-10",
      "title": "Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-02",
      "title": "BeyondTrust detects an attacker using a session cookie from a HAR file it uploaded to Okta support and reports it to Okta",
      "body": null,
      "sourceUrl": "https://www.beyondtrust.com/blog/entry/okta-support-unit-breach",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-28",
      "title": "Attacker access to Okta's support system begins; a report of all support users is run at 15:06 UTC",
      "body": null,
      "sourceUrl": "https://sec.okta.com/articles/october-security-incident-recommended-actions/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-25",
      "title": "Cloudflare starts seeing unusually large HTTP/2 attacks",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    }
  ]
}