Cloudflare WAF — payload size bypass, oversized body, plan-specific limits

Quick answer

The Cloudflare WAF doesn't inspect the whole body: it has per-plan limits (Free ~8 KB, Pro/Business low by default, Enterprise 128 KB). If your payload goes after the limit, the WAF doesn't see it. Classic bypass: padding + real payload at the end of the body. It works on POST/PUT/PATCH, JSON, multipart and form-urlencoded. Combine it with chunked transfer encoding to evade rules that do inspect the first bytes. Real severity only when you chain it with a SQLi/XSS/RCE behind it.

1. The concept: body inspection limits

Cloudflare inspects the first N bytes of the body. Above N, the content passes without analysis to the origin. It's documented by design behavior by Cloudflare — but in bug bounty what matters is the impact on the target's app.

Limits per plan (state post-December 2025)

Cloudflare tried to raise the limit to 1 MB for everyone in December 2025 (CVE-2025-55182, React RCE), but reverted due to massive false positives in managed rulesets. Result: the low limits are still in effect in the vast majority of Free/Pro deployments.

[!tip] Plan detection If you see advanced Bot Management, complex custom WAF rules and cf-ray with enterprise prefixes → probably Enterprise. If the cdn-cgi/trace page doesn't expose advanced features and the cf-cache-status values are basic → Free/Pro.

2. Fingerprint the active WAF

Before firing oversize, confirm the WAF is inspecting the body. Send a basic payload that always triggers managed rules:

# SQLi clásico — debería disparar Managed Ruleset
curl -X POST https://target.com/api/search \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "q=' UNION SELECT password FROM users-- "

# Respuesta esperada con WAF activo:
# HTTP/1.1 403 Forbidden
# server: cloudflare
# cf-ray: <id>-<colo>
# (body con "Attention Required! | Cloudflare")

If you get a 403 → WAF active and inspecting. If it passes with 200/500 → either there's no WAF, or it doesn't inspect that endpoint, or it's already bypassed by default.