Cloudflare response to CPDoS exploits

This post details Cloudflare's defenses against three newly disclosed cache poisoning denial-of-service (CPDoS) vulnerabilities: HTTP Header Method Override (HMO), Oversized HTTP Headers (HHO), and HTTP Meta Characters. For HMO, Cloudflare includes specific method override headers (X-HTTP-Method-Override, X-HTTP-Method, X-Method-Override) as part of customer cache keys to prevent cache poisoning. For HHO and HTTP Meta Characters, Cloudflare's default behavior of not caching HTTP status code 400 responses mitigates the attack vector. An exception is noted for unpatched Microsoft IIS versions that return 404 for oversized headers, recommending updates or removal of headerLimits. The post reiterates Cloudflare's commitment to industry standards and active defenses against caching pitfalls.