Incident Library
Applied filters Root causeConfiguration changeComponentCDN and edge networkSymptomHigh latencyClear allEvery case under the filters, with no sentence; newest first.
Suggested filters Search, and the values found in your words appear here.

Graph

  • Root cause
  • Component
  • Symptom
  • Contributing factor
  • Case

Cases2 cases

1 to 2 of 2

  1. IL-0283 Cloudflare's core proxy returned HTTP 5xx across its network after loading an oversized Bot Management feature file
    Cloudflare2025
    Symptoms

    From about 11:20 UTC on 18 November 2025, Cloudflare's network started failing to deliver core traffic, and Internet users visiting Cloudflare customers' sites got an error page that pointed to a failure inside Cloudflare's network. The volume of HTTP 5xx responses served by the network jumped far above its normal low baseline.

    High error rateService outageHigh latencyResponse quality degradation
    Trigger

    At 11:05 UTC Cloudflare deployed a ClickHouse access control change that made users' existing implicit access to the underlying tables in the r0 database explicit, so the metadata of those tables became visible in system tables such as system.columns. The change was being rolled out gradually across the cluster.

    Root cause
    Configuration change
    Component
    DatabaseCDN and edge network
    Contributing factor
    Unverified assumptionPartial rolloutNo staged rolloutNo configuration testsOverlapping failuresRetry storm
    Detection

    The first automated test detected the issue at 11:31 UTC, three minutes after the first errors on customer HTTP traffic at 11:28. Manual investigation started at 11:32 and the incident call was created at 11:35.

    Remediation
    • Bypassed the core proxy for Workers KV and Access so they fell back to a prior proxy version, which reduced their impact
    • Stopped the automatic creation and deployment of new Bot Management feature files
    • Inserted a known good feature file into the distribution queue and deployed it globally
    • Forced a restart of the core proxy
    • Scaled control plane concurrency to clear the backlog of dashboard logins
    • Restarted the remaining services that had entered a bad state
    Action items
    • Harden the ingestion of Cloudflare-generated configuration files the same way as user-generated input
    • Enable more global kill switches for features
    • Stop core dumps and other error reports from being able to overwhelm system resources
    • Review the failure modes for error conditions across all core proxy modules
    View case
  2. IL-0339 Azure Front Door and Azure CDN users saw intermittent connection errors, timeouts and latency spikes for hours
    Microsoft Azure2024
    Symptoms

    From 11:45 UTC on 30 July 2024, a subset of customers got intermittent connection errors, timeouts and latency spikes when connecting to Microsoft services that use Azure Front Door (AFD) and Azure Content Delivery Network (CDN). The Azure Portal team saw the first service degradation at 11:47 UTC.

    Intermittent connection failuresIntermittent timeoutsHigh latencyPacket loss
    Trigger

    Around 11:45 UTC the Azure network DDoS protection service was disengaging after a routine DDoS mitigation and returning traffic to its default routing to AFD, but the routes at one site in Europe could not be updated because the network control plane could not reach that site during a local power outage.

    Root cause
    Configuration change
    Component
    CDN and edge networkDDoS protection serviceNetwork control plane (SDN)Data center power and cooling
    Contributing factor
    Overlapping failuresExcessive blast radiusMonitoring blind spot
    Detection

    The Azure Portal team detected service degradation at 11:47 UTC and began to investigate. At 12:10 UTC network monitoring correlated the Portal incident to a network issue at one site in Europe, and networking engineers joined.

    Remediation
    • Rerouted traffic under the standard congestion playbook, which removed most of the impact by 13:58 UTC
    • Ordered the network control plane to reissue its commands to the misbehaving device, which could not be reached
    • Removed the device that kept attracting traffic from the network and scanned the network for other issues
    Action items
    • Add the missing configuration on network devices so a DDoS mitigation issue in one geography cannot spread to another
    • Improve validation and monitoring in the Azure network to detect invalid configurations
    • Improve monitoring for when the DDoS protection service is unreachable from the control plane but still serving traffic
    View case
Check your cluster for this

These 2 cases involve CDN and edge network and Database. kubegap audits a Kubernetes cluster for gaps like these, read-only, from Claude Code or Codex; its checks cite public reports like the ones in this library.

Open kubegap

By root cause1

Configuration change2 cases

Component
CDN and edge network2Database1Data center power and cooling1DDoS protection service1Network control plane (SDN)1
Contributing factor
Overlapping failures2Unverified assumption1Excessive blast radius1Monitoring blind spot1No configuration tests1No staged rollout1Partial rollout1Retry storm1
Organisation
Cloudflare1Microsoft Azure1
  1. IL-0283 Cloudflare's core proxy returned HTTP 5xx across its network after loading an oversized Bot Management feature file
    Cloudflare2025
  2. IL-0339 Azure Front Door and Azure CDN users saw intermittent connection errors, timeouts and latency spikes for hours
    Microsoft Azure2024