A latent buffer-overflow flaw in Cloudflare’s Ragel-based parser began leaking server memory after a buffering change associated with the company’s migration to cf-html. From September 22, 2016, until the issue was fixed in February 2017, leaked memory could contain HTTP cookies, authentication tokens, POST bodies, passwords, encryption keys, client IP addresses, and complete HTTPS requests. Cloudflare said the leak occurred more than 18 million times, with the highest-risk period running from February 13 through February 18, 2017; approximately one in 3.3 million requests potentially disclosed memory.
Google Project Zero researcher Tavis Ormandy reported the vulnerability to Cloudflare on February 17, 2017, after obtaining private messages, chat content, hotel bookings, and other sensitive data in a proof-of-concept test. Some exposed material was cached by search engines, and Cloudflare acknowledged that one of its machine-to-machine encryption keys had leaked. CTO John Graham-Cumming said customers including Uber and OkCupid were not directly contacted during the response because of the security risks. Cloudflare reported no evidence of malicious exploitation, while Ormandy later criticized what he described as the company’s downplaying of customer risk. The incident prompted password and session-token resets across affected services and became a major warning about the concentration of sensitive traffic in content-delivery networks.
