Cloudflare outage of November 18, 2025
A global Cloudflare network outage caused by an internal configuration file that grew too large after a database permissions change, with no attack involved.
A delivery and protection network sitting in front of millions of websites constantly receives automatically regenerated configuration files, such as the list of signals used by its bot detection model. On November 18, 2025, a permissions change on a ClickHouse cluster caused the query that builds this file to return duplicate rows: the file exceeded the 200-entry limit hard-coded in the proxy, which crashed instead of discarding the bad file. Because the file was regenerated every five minutes and only some database nodes produced the bad version, the network first flapped between failure and recovery, which for a while suggested an attack. The case illustrates a rule that underwriting an infrastructure provider should check: machine-generated configuration data deserves the same validity checks as human input, or the fast distribution mechanism becomes the vector of the outage.
On November 18, 2025, Cloudflare's network stopped delivering core traffic at 11:20 UTC; pushing out a known-good file restored most service around 14:30, and all systems were back to normal by 17:06 UTC. In its public postmortem, Cloudflare ruled out any cyberattack and traced the outage to the feature file of its Bot Management module, which had grown from about 60 to more than 200 entries.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.