Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The headline refers to Cloudflare’s November 18, 2025 global outage—not the separate June 12 Workers KV incident. Cloudflare says an internal ClickHouse permissions change exposed unexpected database metadata, producing an oversized Bot Management configuration file. The file triggered a panic in part of Cloudflare’s core proxy and caused widespread HTTP 5xx errors. The company says the incident was not a cyberattack.
What Cloudflare apologized for
In its postmortem, Cloudflare called the outage unacceptable and said it had failed customers and the wider Internet. The company characterized it as its worst outage since 2019. The failure affected core traffic processing as well as products that depend on Cloudflare’s shared proxy infrastructure.
Cloudflare’s account is important because this was not simply “the bot-protection service going down.” A defect in an internally generated configuration file moved through a security module and into the request-processing path used by ordinary web traffic.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The chain of failure
ClickHouse permissions change
↓
Extra r0 metadata exposed
↓
Duplicate feature rows
↓
Bot Management file grows beyond expected size
↓
Feature limit exceeded
↓
Proxy module panics
↓
HTTP 5xx errors and downstream failures1. A database permissions change
At 11:05 UTC, Cloudflare changed ClickHouse access controls as part of work intended to make distributed queries more secure and reliable. The change made underlying r0 tables visible to a query that generated Bot Management’s frequently refreshed feature file.
#1 Best Overall
2. An unfiltered metadata query returned duplicates
The query assumed that metadata would come only from the default database. It did not constrain results by database name. Once the additional schema became visible, the query returned duplicate column metadata. The resulting feature file grew to more than twice its normal size.
3. The file exceeded a hard limit
Bot Management normally uses about 60 features. The relevant software was configured to support a maximum of 200. The generated file exceeded that limit after the duplicate rows were included.
Cloudflare’s FL2 proxy code used a preallocated-memory design for performance. Instead of treating the file as invalid input and rejecting it safely, the code panicked. The postmortem shows the error as:
thread fl2_worker_thread panicked: called Result::unwrap() on an Err valueThat distinction matters. The database change did not directly “crash the Internet.” The outage required a sequence of latent assumptions and missing safeguards: unexpected metadata, inadequate validation, broad distribution of the bad file, and an unhandled limit violation.
4. A local module failure became a network incident
Bot Management runs inside Cloudflare’s core traffic-processing path. When the module failed, affected FL2 proxy workers returned HTTP 5xx responses for requests passing through them. Because many Cloudflare products share that infrastructure, the impact spread beyond bot scoring.
Who and what was affected?
Reported symptoms included Cloudflare-generated 5xx pages, websites that would not load, failed authentication, dashboard problems, and Turnstile challenges that did not load. Workers KV and Cloudflare Access also degraded, and other services depending on the core proxy entered unhealthy states.
Impact was not identical for every customer:
- Customers using the newer FL2 proxy engine generally saw 5xx errors when the failing module was exercised.
- Customers on the older FL engine did not necessarily see errors, but Bot Management scores could be missing or become zero.
- Sites that blocked requests based on bot scores could therefore experience false positives even without widespread 5xx responses.
Contemporary reports named services including ChatGPT, X, Shopify, Dropbox, Coinbase and League of Legends among those disrupted, but these reports should not be read as evidence that every service had the same failure or duration. Cloudflare’s product-level impact varied with configuration and dependency.
Free tools Windows power users keep installed
One-click scans. No signup required.
Timeline: why reports cite different durations
| Time (UTC) | Event |
|---|---|
| 11:05 | ClickHouse permissions changed. |
| 11:20 | Cloudflare’s incident summary places the beginning of significant core-traffic failures. |
| 11:28 | The detailed timeline records the bad deployment reaching customer environments and the first observed customer HTTP errors. |
| 14:30 | Core traffic was largely flowing normally after Cloudflare stopped propagating the bad file and restored a known-good version. |
| 17:06 | Cloudflare reported all services restored. |
The 11:20 and 11:28 times describe different milestones: an incident-level start versus the first documented customer-facing deployment and errors. Likewise, “recovered” can mean core proxy traffic was restored while individual products were still restarting or clearing backlogs.
Was Cloudflare hacked or hit by a DDoS?
Cloudflare said no. The company stated that the outage was not directly or indirectly caused by a cyberattack or malicious activity. Engineers initially investigated a possible hyper-scale DDoS because errors and traffic levels fluctuated. Cloudflare’s status page was also unavailable, but the company described that as coincidental rather than evidence of an attack.
Rank #4
The careful conclusion is: Cloudflare found no evidence in its published account that an attack caused the outage. The incident was an internal configuration and software failure.
How Cloudflare restored service
Engineers first bypassed the core proxy for Workers KV and Access to reduce downstream pressure. They then identified Bot Management as the source of the 500 errors, stopped generating and distributing new feature files, restored a previous known-good file and deployed the corrected version globally.
Some dependent services had entered bad states and had to be restarted. Later, retries and login attempts created a dashboard control-plane backlog, so Cloudflare increased dashboard concurrency to clear that secondary degradation.
Best Value
- Used Book in Good Condition
What Cloudflare says it will change
The company listed four immediate hardening efforts:
- Treat Cloudflare-generated configuration files like user-generated input during ingestion.
- Add more global kill switches so features can be disabled quickly.
- Prevent core dumps and other error reports from consuming excessive resources.
- Review failure handling for error conditions across core proxy modules.
In engineering terms, those measures point toward schema and size validation, canary distribution, automatic rollback, graceful degradation and stronger isolation between optional security features and basic traffic routing. Those are resilience lessons rather than guarantees that every risk has been eliminated.
What website operators should learn
The incident does not prove that Cloudflare is uniquely unreliable. It does show the consequences of concentrating CDN, DNS, WAF, bot protection, authentication and application services behind shared building blocks.
- Keep monitoring independent of the provider’s status page.
- Document and regularly test emergency origin access and DNS or traffic-routing changes.
- Know whether WAF, bot checks and Turnstile fail open, fail closed or degrade selectively.
- Ensure critical authentication does not depend on exactly the same edge path as public delivery.
- Consider a second CDN or provider-independent traffic-steering plan for critical services.
- Test whether cached public content, APIs and existing sessions behave differently during control-plane failures.
Multi-CDN designs can reduce concentration risk, but they add cost, configuration drift, policy coordination and operational complexity. The right choice depends on recovery objectives, compliance needs and the ability to operate a fallback under pressure.
Do not confuse it with the June outage
Cloudflare also published a postmortem for a June 12, 2025 Workers KV outage. That was a different incident involving a storage dependency and affected products such as Access, WARP, Gateway, Workers AI, Stream and Images. It was not the cause of the November network outage.
Bottom line
Cloudflare’s November 18 outage was a cascading internal failure: a permissions change exposed extra metadata, an unfiltered query duplicated Bot Management features, an oversized file exceeded a software limit, and a proxy panic turned the malformed configuration into widespread 5xx errors. Cloudflare says it was not an attack. The lasting lesson for customers is to validate internally generated configuration as rigorously as external input and to maintain tested escape routes when one edge provider carries too many critical functions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
