Cloudbleed (2017): A Parser Bug That Leaked Other Customers Data Into Web Pages
Summary
In February 2017, Google Project Zero researcher Tavis Ormandy discovered that Cloudflare's edge servers were leaking uninitialised memory into HTTP responses. Because Cloudflare sat in front of a very large number of websites, the leaked memory could contain data belonging to entirely unrelated customers, including cookies, authentication tokens, and private messages.
Technical Root Cause
The bug was a buffer overrun (CWE-125, out-of-bounds read) in Cloudflare's HTML parser, triggered by malformed HTML in specific configurations involving certain optional features. When triggered, the parser read past the end of its buffer and appended whatever adjacent memory contained to the response body.
Cloudflare's own analysis estimated the greatest period of impact ran from 13 to 18 February 2017, with roughly 1 in every 3.3 million HTTP requests potentially leaking memory. Cloudflare's incident response was rapid, with initial mitigation within roughly an hour of the report.
Why It Mattered
The multi-tenant architecture is what turned a parser bug into a cross-customer data exposure. A site with impeccable security could have its users' session tokens leaked through a different, unrelated site that happened to share edge infrastructure and trigger the bug.
The secondary problem proved harder than the fix. Leaked data appeared in ordinary web page responses, which search engines had crawled and cached. Remediation therefore required working with Google, Bing, Yahoo and others to purge cached copies, a cleanup that extended well beyond patching the parser.
OWASP / CWE Mapping
- CWE-125: Out-of-bounds Read
- OWASP A01:2021: Broken Access Control (cross-tenant data exposure in effect)
Lasting Impact
Cloudbleed belongs to the same bug class as Heartbleed and Citrix Bleed: an out-of-bounds read returning adjacent memory. All three demonstrate that memory disclosure bugs are worse than their severity score often suggests, because the attacker does not choose what leaks and the defender cannot easily determine what did.
It also established that for this bug class, patching is the start of remediation rather than the end. Cached and replicated copies of leaked data persist independently, exactly as stolen sessions persisted through patching in Citrix Bleed.
How Safeguard Helps
Third-party and vendor risk assessment covers this shape of exposure, where an organisation's data can be affected by a defect in infrastructure it does not operate and cannot patch itself.
References
- Cloudflare incident report: https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
- CWE-125: https://cwe.mitre.org/data/definitions/125.html
