Attributed metadata history
Up to 100 retained publisher events per page for 496d3d261cf16c77c9dd15d19a653d7d2ec5b6de65a99e0f5a3bc844bf7ab2a0. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_732996d4d78decf6b7
observed · 2026-10-12 11:25:04 UTC
available
Fingerprint: 9a0f29d779ed105525dbafb009db821a5ae58acc46f95bd8f9161f2e63576dd8
intelligence_src_732996d4d78decf6b7
observed · 2026-10-12 11:25:04 UTC
What's Changed ⚠️ Breaking Change Requires libmodsecurity v3.0.16 or later when running on nginx/libmodsecurity v3. The XML attribute injection fix (ctl:ruleRemoveTargetByTag=...;XML://@* in rule 901181) depends on owasp-modsecurity/ModSecurity#3589, which fixes the lexer's rejection of @ in ctl:ruleRemoveTarget* actions. On libmodsecurity v3 versions older than v3.0.16, this ctl action fails to parse, breaking config load. Fully opting out of XML attribute inspection (tx.crs_xml_attr_inspect) requires ModSecurity v2 >= v2.9.14, once owasp-modsecurity/ModSecurity#3591 is fixed upstream. Until then, ctl:ruleRemoveTargetByTag cannot remove the XML://@* target on ModSecurity v2, so rule 901181 cannot disable attribute inspection on that engine. ⭐ Important changes fix: R7U-260618 v3 by @fzipi in 4665b6d (GHSA: GHSA-f5qm-3h4p-8qhg) fix: N7Y-260316 v3 by @fzipi in 635cecf (GHSA: GHSA-6jp8-c2w2-x7wr) Full Changelog: v3.3.9...v3.3.10
Fingerprint: 8526ab61e78b2aa548c5c3ca3fa568efba1c72cfc83d9ef31d4e7aa88257e3d1