Vulnerability transparency: why disclosure matters

Cloudflare has joined the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) “Secure by Design” pledge as of May 2024. The pledge centers on a set of security goals that prioritize customer safety, including a strong emphasis on transparent vulnerability reporting. For Cloudflare, this aligns with an existing Product Security philosophy: that openness about vulnerabilities is foundational to earning and keeping the trust of customers, partners, and the broader security community.

Transparency in vulnerability reporting is about more than compliance. Linus Torvalds observed in 2008 that “disclosing is the fixing of the bug,” but that mindset scales poorly to non-expert users and enterprise customers who need structured, clearly communicated disclosures about a vulnerability’s impact. The modern threat landscape demands both rapid remediation and clear communication about the nature, impact, and resolution of security issues — which builds trust and contributes to a broader understanding of common vulnerability classes and systemic flaws.

From CVE to disclosure

Common Vulnerabilities and Exposures (CVE) is a catalog of publicly disclosed vulnerabilities. Each CVE record includes a unique identifier, summary, and metadata such as Common Weakness Enumeration (CWE), Common Platform Enumeration (CPE), and a severity score ranging from None to Critical. CVE IDs follow a fixed format — the year of disclosure and a sequence number, such as CVE-2017-0144. Memorable names like “EternalBlue” are sometimes attached to high-profile exploits to aid recall.

As a CVE Numbering Authority (CNA), Cloudflare can assign CVE identifiers for vulnerabilities in its products and ecosystems. Cloudflare has been involved with MITRE’s CVE program since 2009. As a CNA, Cloudflare manages disclosure timelines to keep them accurate, complete, and useful to the industry.

Cloudflare issues CVEs for vulnerabilities found internally or through its Bug Bounty program when they affect open source software or distributed closed source products. Findings are triaged based on real-world exploitability and impact. Vulnerabilities with no plausible exploitation path, along with findings involving test repositories or exposed credentials like API keys, typically do not qualify for CVE issuance.

CVE issuance involves nuance, particularly for complex security issues in a large codebase — the Linux kernel is one example. Whether a CVE is issued depends on user impact and the likelihood of exploitation, which in turn depends on attack complexity. The overall increase in CVEs industry-wide reflects an effort to balance theoretical vulnerabilities against real-world risk.

When a vulnerability impacts Cloudflare but the root cause lies within another CNA’s product scope, Cloudflare does not assign the CVE. In those cases, other disclosure channels — such as blog posts — are used instead.

Cloudflare’s disclosure process

Disclosure begins internally with an evaluation of severity, scope, and any privacy or compliance concerns. Cloudflare engages its Legal and Security Incident Response Teams (SIRT) when necessary. For externally reported vulnerabilities via the Bug Bounty program, the standard disclosure timeline is 90 days, allowing time for remediation, thorough testing, and coordinated response. Cloudflare also issues security advisories on GitHub for open source projects, and encourages external researchers to publish findings after issues are remediated. Full details are available on the Bug Bounty program policy page.

Disclosed vulnerabilities and outcomes

Cloudflare has issued and disclosed multiple CVEs to date. Given the platforms and products Cloudflare builds, vulnerabilities have primarily fallen into the areas of denial of service, local privilege escalation, logical flaws, and improper input validation. CVEs in open source repositories are also disclosed promptly. The full list is available via CVE search. Notable examples include:

CVE-2024-1765: quiche memory exhaustion via post-handshake CRYPTO frames

Cloudflare quiche through versions 0.19.1/0.20.0 was vulnerable to unlimited resource allocation, causing rapid memory usage growth in quiche servers or clients. An attacker could repeatedly send unlimited 1-RTT CRYPTO frames after completing the QUIC handshake, and exploitation could continue for an extended connection. The fix was released in quiche 0.19.2 and 0.20.1.

CVE-2024-0212: Cloudflare WordPress plugin information disclosure

The Cloudflare WordPress plugin had an improper authentication flaw that allowed lower-privileged accounts to access data from the Cloudflare API. The fix is in plugin version 4.12.3 and later.

CVE-2023-2754: plaintext DNS transmission in Windows WARP client

The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for DNS servers since WARP acts as a local DNS resolver. On IPv6-capable networks, the client did not assign loopback IPv6 addresses but rather Unique Local Addresses, which under certain conditions could point to unknown devices on the local network — allowing an attacker to view DNS queries. The issue was patched in WARP version 2023.7.160.0.

CVE-2025-0651: improper privilege management in WARP for Windows

A privilege management flaw in Cloudflare WARP for Windows allowed low-privilege users to create symbolic links in the C:\ProgramData\Cloudflare\warp-diag-partials directory. When the “Reset all settings” feature ran, the WARP service — operating with SYSTEM-level privileges — followed these symlinks and could delete files outside the intended directory, including SYSTEM-owned files. The vulnerability affected versions of WARP prior to 2024.12.492.0.

CVE-2025-23419: TLS client authentication bypass via ticket resumption

Cloudflare’s mutual TLS implementation had a vulnerability in session resumption handling. The root cause was in BoringSSL’s TLS session resumption: client certificates were reused from the original session without revalidating the full certificate chain or the handshake’s verification status. Although Cloudflare was impacted, the root cause was in NGINX’s implementation, making F5 the appropriate CNA for the CVE. Cloudflare disclosed via a blog post and the fix followed the respective CVE guidance.

Looking ahead

Organizations that build software are encouraged to review CISA’s “Secure by Design” principles and develop a plan to implement them. The pledge’s seven security goals challenge organizations to think differently about security, prioritizing customer protection. Cloudflare has delivered five of the seven pledge goals, with the remainder planned for May 2025. CVE transparency is an ongoing effort grounded in openness, discipline, and technical excellence — progress updates are available via related blog posts.