Cloudflare Outage Knocks ChatGPT, X and Other Major Sites Offline

A failure at the internet infrastructure company Cloudflare on Tuesday morning left many of the web’s best-known services unreachable for hours, returning error pages to users around the world. Affected services included the social platform X and OpenAI’s ChatGPT, CNBC and NBC News reported, and CNBC listed Shopify, Indeed and other sites among those hit.

Cloudflare said the cause was internal and not malicious. In a post bylined to Chief Executive Matthew Prince, the company said a change to database permissions, deployed at 11:05 UTC, caused a query to return duplicate entries and roughly doubled the size of a “feature file” used by its bot-management system. The file was regenerated every five minutes and pushed across the network. Cloudflare’s bot-management module has a limit of 200 features, while about 60 were normally in use; the oversized file exceeded the limit, and unhandled code in the traffic-handling software caused it to fail and return server errors.

CNBC described the same cause, reporting that Cloudflare said an automatically generated configuration file for managing threat traffic grew beyond its expected size, crashing the software that handles traffic for several services. A spokesperson said the company found no evidence of an attack or malicious activity, and NBC News quoted an outside network analyst, Doug Madory of Kentik, as seeing no sign of a denial-of-service attack. Cloudflare’s engineers had first suspected a large denial-of-service attack, Cloudflare’s own account said, because the network alternated between working and failing as the bad file propagated to more and more machines.

The company began seeing a spike in unusual traffic early in the morning, CNBC reported, and NBC said Cloudflare began investigating just before 7 a.m. Eastern. Customer-facing errors began at about 11:20 UTC, according to the postmortem, and engineers opened an incident call within minutes. The main impact was resolved around 14:30 UTC after a known-good file was deployed globally, and all services were back by 17:06 UTC, or about noon Eastern time, according to Cloudflare. CNBC and NBC News reported that Cloudflare said a fix was in place by mid-morning Eastern time, with NBC citing 9:42 a.m., though CNBC said some users still had trouble with its online dashboard.

The effects reached beyond websites. Cloudflare’s login and bot-detection tools, including its Turnstile challenge service, failed to load for periods, and customers could not always sign in to the dashboard. Cloudflare’s chief technology officer, Dane Knecht, said: “I won’t mince words: earlier today we failed our customers and the broader Internet,” NBC News reported.

“We know we let you down today,” the Cloudflare post said, calling it the company’s worst outage since 2019.

The company said it would validate internally generated configuration files as rigorously as input from users, add more global kill switches for features, keep error reports from overwhelming its systems, and review failure modes across all of its core traffic modules. The outage is a reminder of how much of the web depends on a handful of infrastructure providers: when one fails, services that look unrelated to users fail together.