Cloudflare Edge Errors
Connection Timed Out
Reviewed for reference consistency: August 11, 2026
the origin server took too long to complete the TCP handshake
What 522 Means
The 522 error on the Cloudflare Edge Errors indicates connection timed out — the origin server took too long to complete the tcp handshake. This typically occurs due to extreme server cpu or memory overload delaying responses.
Error 522 means Cloudflare contacted the origin server, but it never completed the TCP handshake within the 15-second window. The silence is the signature: the server is neither refusing nor answering, which points to overload or a firewall dropping Cloudflare IPs instead of rejecting them.
Technical Background
The 522 status represents a symptom of acute network or server exhaustion. A 521 is an active rejection — the origin answers the handshake with a refusal — while a 522 is silence: the origin never acknowledges the attempt, and the proxy eventually stops waiting.
Mechanically, this means the proxy sent an initialization packet to initiate contact, but never received the return packet from the origin within the short window. This is fundamentally a deep networking failure, not an application code issue.
Load balancers and security groups often cause 522 errors if misconfigured. If an appliance decides to silently drop invalid traffic rather than reject it, the persistent silence appears indistinguishable from a server that is crippled by heavy load.
Common Causes
- Extreme server CPU or memory overload delaying responses
- Asymmetric routing causing packet loss in one direction
- Rate-limiting firewalls dropping packets instead of refusing them
- Congested transit links between the edge network and the origin host
Typical Scenarios
- A database query locks the entire server CPU, preventing the OS from acknowledging network traffic
- A malicious attack floods the origin port, causing legitimate traffic to time out in the queue
- A routing error sends return packets to a black hole instead of back to the proxy
What to Know
A 522 error directs diagnostic attention squarely to network appliance rules and overall server load limits. Auditing firewalls to ensure packets from Cloudflare are not being silently dropped is a key operational step.
Frequently Asked Questions
Common questions about Cloudflare 522 error
It means the proxy tried to contact your origin server, but the server did not answer the initial network packet within the maximum waiting period.
A 521 is an immediate rejection: the origin answers the handshake and refuses it. A 522 is a timeout: the origin never answers at all, so the proxy gives up waiting.
Checking server CPU and memory usage to ensure functionality and verifying that firewalls are not silently dropping Cloudflare IPs are the primary resolution steps.
Cloudflare waits approximately 15 seconds for the origin server to establish a TCP connection. If the origin does not respond within this window, Cloudflare returns 522. The threshold can vary slightly depending on Cloudflare plan level and edge configuration, but 15 seconds is the common default observed in production environments.
Related Error Codes
Web Server Returned an Unknown Error — the origin sent unexpected responses to the proxy
Web Server Is Down — Cloudflare cannot establish a TCP connection to the origin server
Origin Is Unreachable — Cloudflare cannot locate a network path to the origin IP
DNS Resolution Error — Cloudflare cannot resolve the hostname provided in the request
Related Errors From Other Categories
Similar error codes documented across different platforms and systems
Process Killed — the process was terminated by a SIGKILL signal
Signal 11 (SIGSEGV) — kernel signal for invalid memory reference segmentation fault
Exit Code 139 — process terminated by segmentation fault (Signal 11 / SIGSEGV)
Input/output error EIO — a read or write operation could not complete