How One Uncaught Rust Exception Took Out Cloudflare

On Nov. 18, 2025 Cloudflare suffered a widespread outage when its new Rust-based FL2 proxy panicked and stopped proxying traffic after an uncaught exception: a dynamically generated “features” file contained duplicate rows that expanded typical feature counts from ~60 to over 200, exceeding a pre-allocated buffer and triggering a panic (“called Result::unwrap() on an Err value”); customers still on the legacy FL proxy were unaffected. The post‑mortem blames inadequate input validation and unhandled error propagation in the FL2 rewrite (which the older FL handled more gracefully), Cloudflare has published the root‑cause, and engineers and commentators have urged rollback and stricter testing of rewrites. For investors this highlights execution, operational and reputational risk at a critical cloud infrastructure provider, potential SLA/contract exposure, and the broader concentration and business‑continuity risks of heavy reliance on a small number of centralized cloud vendors.

Analysis

On Nov. 18, 2025 Cloudflare experienced a major outage when its new Rust‑based FL2 proxy panicked after an uncaught exception: a dynamically generated features file contained duplicate rows that expanded typical feature counts from ~60 to over 200, exceeding a pre‑allocated buffer and triggering thread fl2_worker_thread panic "called Result::unwrap() on an Err value". Customers still on the legacy FL proxy were unaffected, and engineers published a post‑mortem identifying the malformed input and unhandled error as the proximate causes.

The investigation and commentary attribute the failure to inadequate input validation and error handling in the FL2 rewrite—chained processing that accepted an Err value instead of handling it—rather than to a language‑level flaw per se. Observers urged rollback or stricter QA before replacing proven systems; Cloudflare’s transparency in publishing root‑cause details reduces information asymmetry but does not eliminate execution risk.

For investors this event raises measurable operational and reputational risk for NET, potential SLA/contract exposure, and reinforces concentration risk across a small set of cloud providers (AWS, Cloudflare, OVH, CrowdStrike noted). Feed metrics show moderately negative sentiment (overall -0.45; NET -0.6), implying near‑term pressure on infrastructure names; key monitoring points are incident recurrence, remediation timetable, customer churn/SLA claims, and changes to release governance and testing practices.

Key Decisions for Investors

• Reduce or hedge near‑term exposure to NET until Cloudflare documents a completed rollback or delivers verifiable fixes with stable uptime and improved release‑governance metrics
• Require counterparties and portfolio companies to stress test business continuity for single‑provider cloud dependencies and consider reallocating critical workloads away from single‑vendor concentration
• Monitor Cloudflare KPIs closely—time to full remediation, incident recurrence, customer churn/SLA claims, and specific changes to QA/release testing—and adjust position sizing if timelines slip
• Consider short‑dated defensive hedges on cloud/infrastructure names (AMZN, MSFT, GOOGL, CRWD) to protect against correlated operational or reputational spillovers
• Engage management where possible for detailed remediation evidence and insist on third‑party or independent verification before re‑establishing upward exposure