Incident Library
Applied filters Root causeConfiguration changeSymptomPacket lossOrganisationCloudflareClear allEvery case under the filters, with no sentence; newest first.
Suggested filters Search, and the values found in your words appear here.

Graph

  • Root cause
  • Component
  • Symptom
  • Contributing factor
  • Case

Cases1 case

1 to 1 of 1

  1. IL-0394 A Cloudflare router in Miami leaked IPv6 BGP routes to peers and providers for 25 minutes, congesting the backbone
    Cloudflare2026
    Symptoms

    On 22 January 2026 from 20:25 UTC, a Cloudflare edge router in Miami sent unintended BGP advertisements of IPv6 prefixes to its transit providers and peers. External networks' traffic was funnelled into the Miami data center, the backbone between Miami and Atlanta became congested, and some Cloudflare customer traffic saw elevated loss and higher latency.

    Packet lossHigh latency
    Trigger

    At 20:25 UTC Cloudflare's policy automation pushed a change, merged at 19:52 UTC, that removed the BGP announcements from Miami for a data center in Bogotá, Colombia, by deleting the prefix-list 6-BOG04-SITE-LOCAL from several export policy terms.

    Root cause
    Configuration change
    Component
    BGP routingBackbone network (WAN)
    Contributing factor
    No configuration tests
    Detection

    The network team began investigating unintended route advertisements from Miami at 20:40 UTC, and an incident was raised at 20:44 UTC.

    Remediation
    • A network operator reverted the bad configuration change on the Miami router by hand
    • Paused the automation for the router so it could not run again
    • Reverted the triggering change in the network automation code repository
    • Unpaused the automation on the Miami router after confirming it ran without the routing policy bug
    Action items
    • Patch the failure in the routing policy automation that caused the leak
    • Add BGP community-based safeguards that reject routes received from providers and peers on external export policies
    • Add automatic routing policy evaluation to the CI/CD pipelines that looks for empty or erroneous policy terms
    • Detect problems in network configurations and the effects of automated changes earlier
    • Validate routing equipment vendors' implementations of RFC9234 before rolling out BGP roles and the Only-to-Customer Attribute
    • Encourage long-term adoption of RPKI Autonomous System Provider Authorization (ASPA)
    Lessons

    Removing only the prefix lists from export policy terms left terms that were too permissive, because a match on route-type internal accepts IBGP routes as well. Cloudflare states that route leaks are easy to cause by accident and that RFC9234 is the only way, independent of routing policy, to prevent route leaks caused at the local AS.

    View case
Check your cluster for this

This case involves Backbone network (WAN) and BGP routing. kubegap audits a Kubernetes cluster for gaps like these, read-only, from Claude Code or Codex; its checks cite public reports like the ones in this library.

Open kubegap

By root cause1

Configuration change1 case

Component
Backbone network (WAN)BGP routing
Contributing factor
No configuration tests
Organisation
Cloudflare
  1. IL-0394 A Cloudflare router in Miami leaked IPv6 BGP routes to peers and providers for 25 minutes, congesting the backbone
    Cloudflare2026