STATUS IS UPDid you know?
Owner workspace
Explore SIU
  1. Status Is UP
  2. Did you know?
  3. No. 06

Did you know? · No. 06 · Fun fact ·

One WAF regex helped take Cloudflare offline for 27 minutes

A Status Is UP fact card showing “27 min” and “One runaway regex exhausted CPU across the network.”

On July 2, 2019, Cloudflare deployed a minor XSS-detection rule update in its web application firewall. One regular expression backtracked excessively, pushing HTTP/HTTPS-serving CPUs to nearly 100% across its network. Visitors to Cloudflare-powered domains saw 502 errors.

The disruption lasted 27 minutes. Cloudflare identified the WAF, used a global termination mechanism, then tested the rollback before restoring the WAF. The lesson is not that configuration changes are inherently unsafe. It is that rules can execute like code, including in simulate mode, where they do not block traffic but still need processing power. A small rule change can affect every page request, which makes gradual rollout and fast reversal practical safeguards for any site.

Try this on your site

Treat firewall, redirect, caching, and bot-rule changes like code releases. Test new patterns on a small slice of traffic first, and keep a documented rollback ready.

Share this fact

Each fact is checked against the primary sources listed. Spotted an error? Email the Status Is UP team. Status Is UP helps owners improve their sites; it is not an uptime monitor. For live outage status, see Status Is Down.