Attributed metadata history
Up to 100 retained publisher events per page for 985b105de2696316520db86f235f1a71cae32847c081fe626f35cabf8c7659b8. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_732996d4d78decf6b7
observed · 2026-10-12 11:25:04 UTC
available
Fingerprint: 9a0f29d779ed105525dbafb009db821a5ae58acc46f95bd8f9161f2e63576dd8
intelligence_src_732996d4d78decf6b7
observed · 2026-10-12 11:25:04 UTC
v4.25.1 - 2026-07-01 Breaking Changes Requires libmodsecurity v3.0.16 or later. The XML attribute injection fix (ctl:ruleRemoveTargetByTag=...;XML://@* in rule 901181) depends on owasp-modsecurity/ModSecurity#3589, which fixes the lexer's rejection of @ in ctl:ruleRemoveTarget* actions. On ModSecurity v3 versions older than v3.0.16, this ctl action fails to parse, breaking config load. Fully opting out of XML attribute inspection (tx.crs_xml_attr_inspect) requires ModSecurity v2 >= v2.9.14, once owasp-modsecurity/ModSecurity#3591 is fixed upstream. Until then, ctl:ruleRemoveTargetByTag cannot remove the XML://@* target on ModSecurity v2, so rule 901181 cannot disable attribute inspection on that engine. Security Fixes Backport fix for 4RI-250413 via hardening of JSON-encoded key/variable-assignment noise handling across LDAP injection, RCE, generic attack, and SQL injection detection rules (Esad Cetiner, cherry-pick of #4672) Backport ReDoS hardening fix removing exponential backtracking in the PHP function-call comment/whitespace suffix (rules 933160, 933161) (Felipe Zipitría, cherry-pick of #4666) Backport ReDoS hardening fix removing exponential backtracking in the PHP va
Fingerprint: b0111142c658e5cfcaf6dffd9d9a2ce1acca519d96605a8e78ed09bbb6dd78cd