Top 10 winner

1139 - cloudflare: Cloudflare Reverse Proxies are Dumping Uninitialized Memory

1139 - cloudflare: Cloudflare Reverse Proxies are Dumping Uninitialized Memory - project-zero

A flaw in Cloudflare's HTML-rewriting reverse proxy made it emit pages of uninitialized memory whenever a page behind it carried particular unbalanced tags. Because the proxies are shared between customers, the leaked bytes held other sites' encryption keys, cookies, passwords and POST bodies, and crawlers had already cached them.

Record

Document

1139 - cloudflare: Cloudflare Reverse Proxies are Dumping Uninitialized Memory - project-zero

Published by

bugs.chromium.org

Topic

Server

In the archive

• Ranked #5 in the 2016–17 Top 10 Web Hacking Techniques

Tags

• info-leak
• reverse-proxy
• cdn
• cloudflare
• cookie
• http
• case-study
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of bugs.chromium.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.