The following URLs all yield 502 errors for me:
- https://i.sstatic.net/YUYaH.png
- https://i.sstatic.net/LkIZm.png
- https://i.sstatic.net/zYmrw.png?s=32&g=1
- https://i.sstatic.net/
I was alerted to this by another user.
Update: seems to be back up.
The following URLs all yield 502 errors for me:
I was alerted to this by another user.
Update: seems to be back up.
According to Cloudflare Status:
Cloudflare has implemented a fix for this issue and is currently monitoring the results.
We will update the status once the issue is resolved.
So hopefully this is working again.
Update 2019-07-03 00:30 UTC:
An email was sent to Cloudflare customers with the following information:
Dear Cloudflare Customer,
Today at approximately 13:42 UTC we experienced a global service disruption that affected most Cloudflare traffic for 27 minutes.
The issue was triggered by a bug in a software deploy of the Cloudflare Web Application Firewall (WAF) which resulted in a CPU usage spike globally, and 502 errors for our customers. To restore global traffic we temporarily disabled certain WAF capabilities, removed the underlying software bug, then verified and re-enabled all WAF services.
We’re deeply sorry about how this disruption has impacted your services. Our engineering teams continue to investigate this issue and we will be sharing detailed incident report(s) on the Cloudflare blog.
~The Cloudflare Team
There is also a blog post with more details regarding the specific cause of this outage:
The intent of these new rules was to improve the blocking of inline JavaScript that is used in attacks. These rules were being deployed in a simulated mode...
Unfortunately, one of these rules contained a regular expression that caused CPU to spike to 100% on our machines worldwide. This 100% CPU spike caused the 502 errors that our customers saw...
We were seeing an unprecedented CPU exhaustion event, which was novel for us as we had not experienced global CPU exhaustion before...
At 1402 UTC we understood what was happening and decided to issue a ‘global kill’ on the WAF Managed Rulesets, which instantly dropped CPU back to normal and restored traffic. That occurred at 1409 UTC.
We then went on to review the offending pull request, roll back the specific rules, test the change to ensure that we were 100% certain that we had the correct fix, and re-enabled the WAF Managed Rulesets at 1452 UTC.