Details of the Cloudflare outage on July 2, 2019

This post details a significant outage caused by a poorly written regular expression in a WAF Managed Rule that led to CPU exhaustion across the global network. It describes the sequence of events, the impact on customers, and the internal response. Key takeaways include the identification of the root cause (excessive regex backtracking), the challenges faced in responding due to internal system dependencies (Access service, Jira, build system), and the eventual resolution by disabling the WAF globally and then re-enabling it after a fix was verified. The post also contrasts the deployment process for WAF rules with the more phased approach used for general software releases and discusses the need for improved internal access and bypass mechanisms.