cloudflare/cloudflared · error

error parsing cidr string

Error message

error parsing cidr string

What it means

Deserialization guard in cfapi CIDR.UnmarshalJSON: the JSON value for a CIDR field is not a JSON string, so unmarshalling into a string fails before net.ParseCIDR is attempted. Indicates a malformed route payload from the Tunnelstore backend.

Source

Thrown at cfapi/ip_route.go:53

func (c CIDR) String() string {
	n := net.IPNet(c)
	return n.String()
}

func (c CIDR) MarshalJSON() ([]byte, error) {
	str := c.String()
	json, err := json.Marshal(str)
	if err != nil {
		return nil, errors.Wrap(err, "error serializing CIDR into JSON")
	}
	return json, nil
}

// UnmarshalJSON parses a JSON string into net.IPNet
func (c *CIDR) UnmarshalJSON(data []byte) error {
	var s string
	if err := json.Unmarshal(data, &s); err != nil {
		return errors.Wrap(err, "error parsing cidr string")
	}
	_, network, err := net.ParseCIDR(s)
	if err != nil {
		return errors.Wrap(err, "error parsing invalid network from backend")
	}
	if network == nil {
		return fmt.Errorf("backend returned invalid network %s", s)
	}
	*c = CIDR(*network)
	return nil
}

// NewRoute has all the parameters necessary to add a new route to the table.
type NewRoute struct {
	Network  net.IPNet
	TunnelID uuid.UUID
	Comment  string
	// Optional field. If unset, backend will assume the default vnet for the account.

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Inspect the raw JSON response — the CIDR field must be a string like '10.0.0.0/8'.
2. Check for API version drift or a proxy rewriting the response body.
3. Retry the request; persistent malformation should be reported.

When it happens

Trigger: Thrown at cfapi/ip_route.go:53 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/5e4615c2960430f5. Report an issue: GitHub.