What's Changed

🔒 Security

• fix: inspect XML attribute values across attack-detection rules — GHSA-6jp8-c2w2-x7wr
• fix: remove catastrophic backtracking in unix-shell-evasion prefix — GHSA-f5qm-3h4p-8qhg

🆕 New features and detections 🎉

• feat: enable crs_validate_utf8_encoding by default by @fzipi in #4647
• feat: added detection for quote evasion by @Xhoenix in #3813
• feat(934): detect ORM lookup operator injection by @fzipi in #4659
• fix(932): detect uninitialized variable spacer in RCE evasion prefix by @fzipi in #4652

🧰 Other Changes

• refactor: create 941170 .ra file by @fzipi in #4493
• fix: Update restricted-files.data to include NPM subdirectories without causing FPs by @HackingRepo in #4653
• fix: remove exponential backtracking in 933160/933161 comment suffix by @fzipi in #4666
• fix(941140): remove exponential backtracking in CSS url(javascript) detection by @fzipi in #4670
• fix(933180): remove exponential backtracking in variable-function noise suffix by @fzipi in #4669
• fix(942390): move to regex-assembly by @fzipi in #4011
• feat(crs-setup): add default actions for phases 3-5 by @Prateeksaini12 in #4675
• fix(942522): avoid excessive backtracking by @EsadCetiner in #4676
• fix: 4RI-250413 by @EsadCetiner in #4672
• fix: FPs related to RESPONSE_BODY by @azurit in #4684

New Contributors

• @Prateeksaini12 made their first contribution in #4661

Full Changelog: v4.27.0...v4.28.0

v4.25.1 - 2026-07-01

Breaking Changes

• Requires libmodsecurity v3.0.16 or later. The XML attribute injection fix (ctl:ruleRemoveTargetByTag=...;XML://@* in rule 901181) depends on owasp-modsecurity/ModSecurity#3589, which fixes the lexer's rejection of @ in ctl:ruleRemoveTarget* actions. On ModSecurity v3 versions older than v3.0.16, this ctl action fails to parse, breaking config load.
• Fully opting out of XML attribute inspection (tx.crs_xml_attr_inspect) requires ModSecurity v2 >= v2.9.14, once owasp-modsecurity/ModSecurity#3591 is fixed upstream. Until then, ctl:ruleRemoveTargetByTag cannot remove the XML://@* target on ModSecurity v2, so rule 901181 cannot disable attribute inspection on that engine.

Security Fixes

• Backport fix for 4RI-250413 via hardening of JSON-encoded key/variable-assignment noise handling across LDAP injection, RCE, generic attack, and SQL injection detection rules (Esad Cetiner, cherry-pick of #4672)
• Backport ReDoS hardening fix removing exponential backtracking in the PHP function-call comment/whitespace suffix (rules 933160, 933161) (Felipe Zipitría, cherry-pick of #4666)
• Backport ReDoS hardening fix removing exponential backtracking in the PHP variable-function noise suffix (rule 933180) (Felipe Zipitría, cherry-pick of #4669)
• Backport ReDoS hardening fix removing exponential backtracking in CSS url(javascript:...) detection (rule 941140) (Felipe Zipitría, cherry-pick of #4670)

Bug Fixes

• Backport false positive fix for payloads with commas but no whitespace in SQL comment detection (rule 942200) (Esad Cetiner, cherry-pick of #4608)
• Backport false positive fix excluding the pg command from PL1 Unix command detection (Esad Cetiner, cherry-pick of #4613)
• Backport false positive fix for parameter names containing .history (rule 930120) (Esad Cetiner, cherry-pick of #4614)
• Backport fix dropping HTTP/0.9 GET support from request line validation for RFC 9110 compliance (rule 920100) (Felipe Zipitría, cherry-pick of #4621)
• Backport fix so rules 920240 and 920400 use REQBODY_PROCESSOR instead of relying solely on the Content-Type header (Esad Cetiner, cherry-pick of #4639)

Other Changes

• Add default SecDefaultAction for phases 3-5 in crs-setup.conf.example for consistent logging behavior across engines (Prateek Saini, cherry-pick of #4675)

Full Changelog: v4.25.0...v4.25.1

What's Changed

⚠️ Breaking Change

• Requires libmodsecurity v3.0.16 or later when running on nginx/libmodsecurity v3. The XML attribute injection fix (ctl:ruleRemoveTargetByTag=...;XML://@* in rule 901181) depends on owasp-modsecurity/ModSecurity#3589, which fixes the lexer's rejection of @ in ctl:ruleRemoveTarget* actions. On libmodsecurity v3 versions older than v3.0.16, this ctl action fails to parse, breaking config load.
• Fully opting out of XML attribute inspection (tx.crs_xml_attr_inspect) requires ModSecurity v2 >= v2.9.14, once owasp-modsecurity/ModSecurity#3591 is fixed upstream. Until then, ctl:ruleRemoveTargetByTag cannot remove the XML://@* target on ModSecurity v2, so rule 901181 cannot disable attribute inspection on that engine.

⭐ Important changes

• fix: R7U-260618 v3 by @fzipi in 4665b6d (GHSA: GHSA-f5qm-3h4p-8qhg)
• fix: N7Y-260316 v3 by @fzipi in 635cecf (GHSA: GHSA-6jp8-c2w2-x7wr)

Full Changelog: v3.3.9...v3.3.10

What's Changed

🧰 Other Changes

• fix(920240, 920400): don't rely on content-type header by @EsadCetiner in #4639

Full Changelog: v4.26.0...v4.27.0

What's Changed

🆕 New features and detections 🎉

• feat: Add WhatWAF to the scanner list by @HackingRepo in #4566
• feat: Add ghauri to scanner list by @HackingRepo in #4570
• feat: Expand Scanner User Agents List (v2) by @HackingRepo in #4572
• feat: Expanded os files list by @HackingRepo in #4536
• feat(933100): all HTTP headers should be checked by @touchweb-vincent in #4603
• fix(lfi-os-files): add .dockerenv, .DS_Store, META-INF/, WEB-INF/ by @zoutjebot in #4601
• feat(934200): detect Server-Side Template Injection (SSTI) attacks by @zoutjebot in #4600

🧰 Other Changes

• fix(lfi-os-files): require path prefix for .profile by @zoutjebot in #4586
• fix(933150): remove is_int from PHP function names list by @zoutjebot in #4585
• fix(932370): remove url from Windows LOLBIN command list by @zoutjebot in #4587
• fix(920539): prefer a bypass on a named rule rather than n+1 bypass by @touchweb-vincent in #4610
• fix(942290): add word boundary to MongoDB operator detection by @zoutjebot in #4588
• fix: false positive with parameter name .history by @EsadCetiner in #4614
• fix(942410): use common exceptions instead of rule by @fzipi in #4617
• fix(942200): reduce false positives on payloads with comments by @EsadCetiner in #4608
• fix(unix): exclude pg command from pl-1 by @EsadCetiner in #4613
• fix(930130): comment out false positive prone entries by @EsadCetiner in #4607
• fix(920100): drop HTTP/0.9 GET support from request line validation by @fzipi in #4621
• fix: Update restricted files to include Perl subdirectories by @HackingRepo in #4620

New Contributors

• @zoutjebot made their first contribution in #4586

Full Changelog: v4.25.0...v4.26.0

What's Changed

Important ⭐

These below fix CVE-2026-33691:

• fix(933111): prevent whitespace padding bypass in PHP double-extension upload by @fzipi in #4547
• fix(933110): prevent whitespace padding bypass in PHP upload detection by @fzipi in #4546
• fix(944140): prevent whitespace padding bypass in JSP file upload detection by @fzipi in #4548

🆕 New features and detections 🎉

• feat(930130,930140): expand AI-based paths by @Elnadrion in #4540
• feat: add aws security agent in scanners-user-agents.data by @S0obi in #4562
• feat(932390): add shell fork bomb detection rule at PL2 by @fzipi in #4563

🧰 Other Changes

• refactor: create 941250 .ra file by @fzipi in #4520
• refactor: create 942220 .ra file by @fzipi in #4511
• refactor: create rule 931100 and 931110 .ra files by @Xhoenix in #4489
• feat: Adding critical ai dirs that previously not exist by @HackingRepo in #4535
• refactor: create 933140 and 933180 .ra files by @Xhoenix in #4488
• fix(944110,944120,944130,944150,944151,944200,944210,..): don't inspect cookies twice by @touchweb-vincent in #4526
• refactor: create 943120 .ra file by @fzipi in #4506
• fix: false negative 932236 by @franbuehler in #4544
• feat: update list of unix commands by @EsadCetiner in #4446
• fix(932180): prevent whitespace padding bypass in restricted file upload detection by @fzipi in #4549
• fix: harden GitHub Actions workflows by @fzipi in #4553
• refactor: create 941310 .ra files by @fzipi in #4522
• docs: update README by @fzipi in #4556
• refactor: create 941120 .ra file by @fzipi in #4498
• fix(920540): allow rule exclusions for specific targets by @EsadCetiner in #4405
• fix(931130): ensure correct target is logged by @EsadCetiner in #4577

Full Changelog: v4.24.1...v4.25.0

What's Changed

⭐ Important changes

• fix: KP3-260311 v3 - CVE-2026-33691 by @fzipi in 2a8c635

Full Changelog: v3.3.8...v3.3.9

What's Changed

🆕 New features and detections 🎉

• feat(930140): add AI coding assistant artifact protection by @etiennemunnich in #4519
• feat: Expand Scanner Agents by @HackingRepo in #4532

Fixes

• fix(942200): prevent matches against user agent strings by @theseion in #4537
• fix(942480): don't inspect cookies twice by @touchweb-vincent in #4524

🧰 Other Changes

• refactor: create 934130 .ra file by @Xhoenix in #4487
• refactor: create 941330 .ra file by @fzipi in #4492
• refactor: create 944300 .ra file by @fzipi in #4490
• refactor: create 941320 .ra file by @fzipi in #4491
• refactor: create 921160 .ra file by @fzipi in #4497
• refactor: create 921120 .ra file by @fzipi in #4496
• refactor: create 921110 .ra file by @fzipi in #4495
• feat: move 930110 to regex-assembly by @fzipi in #4494
• refactor: create 941190 .ra file by @fzipi in #4499
• refactor: create 941400 .ra file by @fzipi in #4517
• refactor: create 942250 .ra file by @fzipi in #4512
• refactor: create 941370 .ra file by @fzipi in #4518
• refactor: create 944260 .ra file by @fzipi in #4510
• feat: move 943100 to regex-assembly by @fzipi in #4504
• refactor: create 944120 .ra file by @fzipi in #4508
• refactor: create 942450 .ra file by @fzipi in #4513
• refactor: create 942510 and 942511 .ra files with shared include by @fzipi in #4516
• refactor: create 944240 .ra file by @fzipi in #4509
• docs: comment on threshold should be more alarming by @touchweb-vincent in #4330
• chore: add missing regex-assembly comment blocks to rules by @fzipi in #4523
• fix(913100): adding OWASP Nettacker to known scanners list by @securestep9 in #4529
• refactor: create 941300 .ra file by @fzipi in #4521

New Contributors

• @etiennemunnich made their first contribution in #4519
• @securestep9 made their first contribution in #4529
• @HackingRepo made their first contribution in #4532

Full Changelog: v4.24.0...v4.24.1

What's Changed

🆕 New features and detections 🎉

• feat(933100): add detection of smarty template php tag by @touchweb-vincent in #4447

🧰 Other Changes

• fix(932130): use lazy regex by @fzipi in #3730
• chore(943110): move to regex-assembly by @fzipi in #4431
• fix(930130): reduce false positive by @touchweb-vincent in #4451
• fix(920650): don't block on method override if it's not actually being overwritten by @EsadCetiner in #4455
• fix(932340): Add more UNIX FP commands by @ssigwart in #4454
• refactor(951210): convert maxDB leakage rule to regex-assembly by @fzipi in #4468
• refactor(951190): convert Ingres leakage rule to regex-assembly by @fzipi in #4466
• refactor(951140): convert EMC leakage rule to regex-assembly by @fzipi in #4464
• refactor(951110): convert Access leakage rule to regex-assembly by @fzipi in #4463
• fix: handle multi-byte UTF-8 chars in SQL special char detection by @fzipi in #4458
• refactor(951200): convert Interbase leakage rule to regex-assembly by @fzipi in #4467
• refactor(951180): convert Informix leakage rule to regex-assembly by @fzipi in #4465
• refactor(951220): convert MSSQL leakage rule to regex-assembly by @fzipi in #4459
• refactor(951250): convert SQLite leakage rule to regex-assembly by @fzipi in #4460
• refactor(951260): convert Sybase leakage rule to regex-assembly by @fzipi in #4461
• refactor(951130): convert DB2 leakage rule to regex-assembly by @fzipi in #4462
• fix: don't block json variable names called profile on libmodsecurity3/coraza by @EsadCetiner in #4477
• fix(933100): reduce false positive on Extensible Metadata Platform and xsl-stylesheets by @touchweb-vincent in #4445
• feat: move 932190 to regex-assembly by @theseion in #4475
• fix(942200): FP against comma and single quote in French addresses by @theseion in #4476
• fix: add more exclusions for Google Funding Choices cookie by @azurit in #4484

Full Changelog: v4.23.0...v4.24.0

What's Changed

⭐ Important changes

• feat(920640): add rule to enforce content-type if there is body by @fzipi in #4406

🆕 New features and detections 🎉

• feat(lfi): Add detection for Vite.js path traversal (CVE-2025-30208) by @disisto in #4407
• feat: block fake mozilla/5.g user-agent by @EsadCetiner in #4383
• feat: resolve common false positives with ad and tracker cookies by @EsadCetiner in #4378
• fix(ssrf): catch malformed urls by @fzipi in #4410
• feat: block 'trap' command by @azurit in #4422
• feat: prevent php session files to be uploaded by @fzipi in #4412
• feat(930130): improvement of the detection of common debug or error files across CMS platforms by @touchweb-vincent in #4426
• feat(942450): add another hex + binary declaration pattern by @touchweb-vincent in #4374
• feat: update restricted files and file extensions by @EsadCetiner in #4299
• feat(920650): add detection for framework method overrides by @fzipi in #4416
• fix: remove Request-Range Header from rules by @Xhoenix in #4435
• feat: block when Request-Range header is used by @fzipi in #4436

🧰 Other Changes

• fix: remove bypass-vulnerable content types from default allow lists by @RedXanadu in #4365
• feat(931131): removing off domain check by @touchweb-vincent in #4379
• chore(933120): cleaning obsolete variable by @touchweb-vincent in #4417
• chore(941360,941370,941380): cleaning useless capture keyword by @touchweb-vincent in #4419
• chore(933151,933152,933153): cleaning useless variables by @touchweb-vincent in #4420
• feat(942350): added replace keyword + c-type comment evasion by @touchweb-vincent in #4373
• fix(933111): regex should be the same as 933110 by @touchweb-vincent in #4395
• fix: FPs related to maxDB information leakage by @azurit in #4382
• fix: remove non-unix commands from unix rce rules (932230 PL-1, 932235 PL-1, 932250 PL-1, 932260 PL-1, 932220 PL-2, 932236 PL-2, 932239 PL-2, 932237 PL-3) by @EsadCetiner in #4247
• fix(941120): new regex is eligible for Paranoia Level 1 by @touchweb-vincent in #4291
• fix(933150): reduce substring false positive matches by @EsadCetiner in #4340
• fix(942410): cleaning of duplicates with 942151 by @touchweb-vincent in #4336
• fix: add separate rule to match unix commands with no arguments by @EsadCetiner in #4273
• fix(934140): update perl interpolation regex by @fzipi in #4250
• feat(921200): move regexp to regex-assembly by @fzipi in #4409
• fix(934190): add new rule to check localhost variants without scheme by @fzipi in #4429
• feat(941110): all HTTP headers should be checked by @touchweb-vincent in #4326
• feat(941120): all HTTP headers should be checked by @touchweb-vincent in #4327

New Contributors

• @disisto made their first contribution in #4407

Full Changelog: v4.22.0...v4.23.0