Cloudflare Vulnerabilities and Affected Products
Vulnerabilities associated with CIRCL.
Products
Clear product- WARP14 vulnerabilities
- octorpki9 vulnerabilities
- quiche9 vulnerabilities
- WARP Client4 vulnerabilities
- Wrangler4 vulnerabilities
- https://github.com/cloudflare/pingora3 vulnerabilities
- CIRCL2 vulnerabilities
- cloudflared2 vulnerabilities
- cfnts1 vulnerability
- Cloudflare WARP for Windows1 vulnerability
- Cloudflare-WordPress1 vulnerability
- goflow1 vulnerability
- gokey1 vulnerability
- https://github.com/cloudflare/pages-action1 vulnerability
- lol-html1 vulnerability
- lua-resty-json1 vulnerability
- miniflare1 vulnerability
- odoh-rs1 vulnerability
- tokio-boring1 vulnerability
- Universal SSL1 vulnerability
- workerd1 vulnerability
- workers-sdk1 vulnerability
- zlib1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Incorrect calculation in CIRCL secp384r1 CombinedMultThe CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 . CWE-682Feb 24, 2026 | CVSS2.9v4.0 | EPSS0.397% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-1732MEDIUM | Improper random reading in CIRCLWhen sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare deployment cases (error thrown by the Read() function), this could lead to a predictable shared secret. The tkn20 and blindrsa components did not check whether enough randomness was returned from the user provided randomness source. Typically the user provides crypto/rand.Reader, which in the vast majority of cases will always return the righ… | CVSS5.3v3.1 | EPSS0.386% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |