ssl-tls

2 posts

cloudflare

Agents Week: network performance update (opens in new tab)

Cloudflare reports that it became the fastest network in 60% of the world’s 1,000 largest networks by December 2025, up from 40% during Birthday Week 2025. The improvement came from both expanding its global points of presence and optimizing connection-handling software. Cloudflare says it is continuing to target the remaining networks where competitors still lead. ### Measuring Network Performance - Cloudflare analyzes the 1,000 largest networks by estimated population, using APNIC data. - It measures TCP connection time—the time required to complete a TCP handshake—as a practical indicator of users’ perceived Internet speed. - Rankings use the **trimean**, a weighted average of the 25th percentile, median, and 75th percentile, reducing the influence of outliers. - Data comes from Real User Measurements: browsers loading Cloudflare error pages silently download small files from Cloudflare, Amazon CloudFront, Google, Fastly, and Akamai under real network conditions. ### Expanding Points of Presence - New locations in Constantine, Algeria; Malang, Indonesia; and Wroclaw, Poland brought Cloudflare physically closer to users. - In Wroclaw, free-user average round-trip time fell from 19 ms to 12 ms, a 40% improvement. - In Malang, Enterprise traffic improved from 39 ms to 37 ms, a 5% reduction. - However, new locations alone did not account for the increase from 40% to 60% of networks. ### Improving Connection Handling - Cloudflare optimized the software responsible for connection establishment, SSL/TLS termination, traffic management, and proxying. - HTTP/3 adoption and changes to congestion-window management reduced processing time. - Improvements in CPU and memory efficiency allow the global network to handle connections more effectively. - Cloudflare compares this to improving both the efficiency of highway toll booths and the routing of traffic between them. ### Results by December 2025 - Cloudflare was the fastest provider in 60% of the largest networks. - Between September and December 2025, it became fastest in: - 40 additional countries - 261 additional networks - 54 additional U.S. autonomous systems (ASNs) - During December, Cloudflare was on average 6 ms faster than the next-fastest provider. Cloudflare’s conclusion is that continued gains in network reach and software efficiency can produce measurable improvements for users. It plans to focus on the remaining networks where it is narrowly behind competitors, with the long-term goal of being fastest worldwide.

cloudflare

How we mitigated a vulnerability in Cloudflare’s ACME validation logic (opens in new tab)

Cloudflare disclosed and patched a vulnerability in its ACME HTTP-01 validation logic. Certain challenge requests could disable Web Application Firewall (WAF) protections even when Cloudflare was not serving the requested validation token, allowing the request to reach the customer’s origin without normal WAF processing. The issue was reported through Cloudflare’s bug bounty program, and Cloudflare found no evidence of exploitation; customers do not need to take action. ## ACME HTTP-01 Validation - ACME automates the issuance, renewal, and revocation of TLS certificates. - For HTTP-01 validation, a certificate authority checks for a token at: - `/.well-known/acme-challenge/{token}` - When Cloudflare manages the certificate order, it serves the expected token directly. - If the token is not associated with a Cloudflare-managed order, the request may be forwarded to the customer’s origin for validation by another system. ## The Logic Flaw - Cloudflare temporarily disabled certain WAF features for matching ACME challenge requests. - This was necessary because WAF processing could interfere with certificate authorities retrieving valid challenge tokens. - The flaw occurred when a request matched an active token associated with a different zone rather than the requesting hostname. - In that case, Cloudflare disabled WAF protections but forwarded the request to the origin instead of serving an ACME response. - This created a path where requests could bypass applicable WAF rulesets. ## Mitigation - Cloudflare released a code change restricting security-feature bypasses. - WAF features are now disabled only when: - The request matches a valid ACME HTTP-01 token for the requested hostname, and - Cloudflare has the corresponding challenge response to serve. - Requests that do not meet these conditions continue through normal security processing. ## Disclosure and Customer Impact - FearsOff researchers reported the vulnerability on October 13, 2025, through Cloudflare’s bug bounty program. - Cloudflare patched the issue and reported no evidence of malicious exploitation. - Customers require no configuration changes or other action. Cloudflare’s recommended outcome is continued use of the platform without customer intervention, while its security team emphasizes responsible disclosure and rapid, transparent remediation.