Incident report on memory leak caused by Cloudflare parser bug

This post details a critical security incident where a memory leak in Cloudflare's HTML parser (Ragel-based) led to the potential exposure of sensitive data like cookies and POST bodies. It highlights the rapid response to identify the root cause, disable affected features (email obfuscation, server-side excludes, automatic HTTPS rewrites), and deploy a global patch within hours. The post also provides a deep technical dive into the bug's origin in pointer arithmetic and buffer handling, and explains why it manifested after the introduction of a new parser (cf-html). This incident underscores Cloudflare's commitment to transparency and its ability to quickly address security vulnerabilities impacting its infrastructure.