Bug Bounty

Cloudflare patched a vulnerability (CVE-2025-4366) in the Pingora OSS framework, which exposed users of the framework and Cloudflare CDN’s free tier to potential request smuggling attacks.

Edward Wang, Andrew Hauck, and Aki Shugaeva

Cloudflare was recently contacted by researchers who discovered a broadcast amplification vulnerability through their QUIC Internet measurement research. We've implemented a mitigation.

Josephine Chow, June Slater, Bryton Herdes, and Lucas Pardue

Cloudflare strengthens its commitment to cybersecurity by joining CISA's "Secure by Design" pledge. In line with this commitment, we're enhancing our vulnerability disclosure policy by launching a VIP bug bounty program, giving top researchers early access to our products. Keep an eye out for future updates regarding Cloudflare's CISA pledge as we work together to shape a safer digital future.

Sri Pulla, Trishna, and David Haynes

The Workers AI and AI Gateway team recently collaborated closely with security researchers at Ben Gurion University regarding a report submitted through our Public Bug Bounty program. Through this process, we discovered and fully patched a vulnerability affecting all LLM providers. Here’s the story

Celso Martinho and Michelle Chen

Recently, a vulnerability was reported to our bug bounty about a bug in the way some of our code interprets IPv4 addresses mapped into IPv6 addresses.

Lucas Ferreira, Aki Shugaeva, and Yuchen Wu

The Cloudflare Bug Bounty has resulted in numerous security improvements to Cloudflare Pages

Evan Johnson and Natalie Rogers

Recently, a RCE vulnerability in the way cdnjs’ backend is automatically keeping web resources up to date has been disclosed. Read about how Cloudflare handled the security incident and what will prevent similar exploits in the future.

Jonathan Ganz, Thomas Calderon, and Sven Sauleau