Attributed metadata history

v4.25.2 (LTS)

v4.25.2 - 2026-10-02 Security Fixes Backport fix for [GHSA-575j-qr6p-9763] via adding REQUEST_FILENAME to the targets of the RCE rules, so command injection payloads placed in the URL path are inspected like those in ARGS (rules 932125-932390, except 932200, where every URL path contains the / it requires) (Max Leske) Backport fix for [GHSA-89h9-2j8h-9gp2] via lowercasing the charset parameter name before matching, so an uppercase or mixed-case CHARSET= in Content-Type can no longer skip the charset allow-list check (rule 920480) (Felipe Zipitría) Backport fix for [GHSA-qmx4-jfcv-fgww] via collecting every _charset_ value so a second multipart part or a query-string _charset_ can no longer shadow a disallowed charset (rule 922100) (Ervin Hegedüs) Backport fix removing a bypassable length bound in the SQL (X)OR injection detection (rule 942390) (Felipe Zipitría, cherry-pick of #4713) Backport fix for [V29-260924] via tolerating trailing slashes as well as dots after the extension, so a PHP or JSP upload filename ending in / can no longer bypass the upload extension checks (rules 933110, 944140) (Felipe Zipitría, cherry-pick of #4815) Bug Fixes Backport false positive fix for the vega scanner user agent substring matching veganism.social (rule 913100) (Esad Cetiner, cherry-pick of #4777) Backport fix so tx.crs_skip_response_analysis also skips the phase 4 response body rules; previously only the phase 3 header rules were skipped (new rule 950022) (Jozef Sudolský, cherry-pick of #4807) Other Changes Backport allowing and JSON-parsing application/*+json content types (including subtypes that contain a +, such as application/vc+ld+json) and the AWS application/x-amz-json-1.0/1.1 content types by default, so these JSON request bodies are no longer blocked by the content-type allow-list or left uninspected (new rules 901360, 901370) (Felipe Zipitría, cherry-pick of #4775 and #4828) Formalize rule 932171 (Shellshock, CVE-2014-6271) into a regex-assembly file and apply the standard [\s\x0b] whitespace-class normalization; the json. ARGS_NAMES prefix detection itself was already present on this branch via an untracked fix, so this is a maintainability/consistency change, not a functional fix (partial cherry-pick of #4703)

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.