Cloudflare/2019-07-02/27 min
The regex that ate every CPU
Jan 2019Dec 2019
Global 502s across ~10% of the web — Discord, Shopify, and Cloudflare's own dashboard went dark.
Lesson
Config changes need the same staged rollout as code. "It's just a rule" is how a global outage starts.
Trigger
A new WAF managed rule for XSS detection was pushed to every edge server worldwide in a single deploy.
Mechanism
The rule contained a regex with catastrophic backtracking. On every HTTP request it drove CPU to 100% across all edge cores at once. A CPU guard that would have caught it had been removed in an earlier refactor.
Interview lens
Roll out rules gradually, and stop the rollout automatically if CPU use or latency jumps.
Recurring patterns
