Cloudflare outage traced to misconfigured database update, not cyberattack

Cloudflare has confirmed that its global outage on 18 November was caused by an internal configuration error rather than a cyberattack, after a malformed permissions update pushed parts of its routing software beyond hard-coded limits. The failure originated from a ClickHouse database cluster, where duplicated metadata unexpectedly inflated a machine-learning feature file. The oversize file exceeded a strict size threshold in Cloudflare’s edge routing stack, causing widespread service crashes across its network.

The corrupted file propagated unevenly through Cloudflare’s infrastructure, triggering intermittent recoveries that initially led engineers to suspect a possible attack. Confusion deepened when the company’s externally hosted status page briefly became unreachable, prompting concerns about coordinated targeting. Once the root cause was identified, Cloudflare described the incident as a cascading failure of internal systems. Core services, including its CDN, security layers, Workers KV, Turnstile, and Access, suffered global disruption. Only some legacy proxies absorbed limited traffic, but authentication, bot scoring, and routing processes malfunctioned, contributing to elevated latency and blocked requests.

Why does it matter?

The outage matters because Cloudflare has become embedded in the daily functioning of the internet. Cloudflare outage exposes the Internet’s dependence on a few critical infrastructure providers. The company provides CDN, DNS, caching, routing, and security services to roughly 7.5 million active websites, and by its own account, helps handle traffic for roughly 20 percent of the web. That level of concentration means that when Cloudflare fails, large segments of global traffic slow down or stop altogether.