One Regex Took Down Cloudflare for 27 Minutes
Post · Oct 12, 2026
On 2 July 2019 a single new firewall rule pushed every HTTP-serving CPU in Cloudflare's network to nearly 100% and dropped around 80% of its traffic. Not an attack, not a hardware failure: seven characters of regex, a backtracking engine, and a deploy path built to skip the canaries. A walk through why `.*.*=.*` eats a CPU, and why every safeguard that should have stopped it failed on the same day.