# Bypass of Cloudflare's Cache Keys and WAF via header overflow

Sending 94+ headers caused Cloudflare Front Line to stop evaluating cache keys and WAF rules, enabling cache poisoning, stored XSS, and WAF bypass.

- Payout: $1,250
- Severity: high
- Program: Cloudflare Public Bug Bounty
- Found by: david96
- Disclosed: 2025-11-18
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/3027461
- Library page: https://bugbountylibrary.com/r/h1%3A3027461
- Tags: area:cloud domain:infra domain:web impact:dos impact:integrity kind:bounty platform:hackerone sev:high tech:nginx technique:chained vuln:cache-poisoning vuln:misconfiguration vuln:xss

**Target:** Cloudflare Front Line HTTP header parsing / cache and WAF rulesets
**Root cause:** OpenResty-based Front Line parses a maximum of 100 headers (including internal ones); once exceeded, evaluation of cache keys, cache rules, and WAF rulesets on headers ceases.
**Steps:**
1. Send a request with 94+ arbitrary headers (e.g. repeated `1: 1`) followed by a keyed header such as `X-HTTP-Method-Override: HEAD` and `Host: victim.com`.
2. Observe that Cloudflare stops evaluating custom/default cache keys and cache rules once header count exceeds 94.
3. Append a header normally in the cache key after the overflow to manipulate the cached response.
4. For WAF bypass, place a malicious payload in `User-Agent` after 94+ filler headers so WAF rules inspecting headers are skipped.
5. Chain with a reflecting origin to poison cache and achieve stored XSS.
**How found:** Researcher noticed Cloudflare's documented header truncation behavior (http.request.headers.truncated) and the 100-header OpenResty parse limit, then tested placing keyed headers after a 94-header overflow to see if cache key and WAF evaluation were skipped.
**Exploitation:** Attacker floods request with 94+ filler headers so Cloudflare's parser truncates before reaching keyed headers; a keyed header (e.g. X-HTTP-Method-Override) or malicious User-Agent placed after the overflow is excluded from cache key/WAF evaluation, letting attacker force caching of uncacheable responses and deliver stored XSS or cache-poisoning DoS to all customers.
**Escalation:** Chained cache-key bypass with WAF bypass and origin header reflection to escalate from cache forcing to stored XSS affecting all Cloudflare customers.
**Insight:** When a proxy documents a header-count truncation field, test whether security-relevant headers placed after the truncation boundary are silently dropped from cache-key and WAF evaluation rather than blocked.