fabriziosalmi/patterns 2026-10-18-crs-v4.30.0

WAF rules 2026-10-18-crs-v4.30.0

on GitHub

Patterns build · 2026-10-18

OWASP Core Rule Set coreruleset/coreruleset@v4.30.0 converted into native WAF rules for four web servers. Generated automatically; no manual edits.

Coverage: 748 patterns across 22 categories — SQLi, XSS, RCE, LFI, RFI, plus generic anomaly and protocol-violation rules.

What changed since the previous release

Rules: CRS v4.29.0 to v4.30.0. 7 added, 8 removed, 38 changed, 703 unchanged.

Phrase lists the rules read (6)

• restricted-upload.data is gone
• lfi-os-files.data: 14 added, 0 removed (read by 930120, 930121)
• restricted-files.data: 14 added, 0 removed (read by 930130)
• ruby-errors.data: 1 added, 1 removed (read by 956100)
• scanners-user-agents.data: 2 added, 1 removed (read by 913100)
• unix-shell.data: 46 added, 0 removed (read by 932160, 932161)

Written differently by a target (11)

• 932180 on Nginx: dropped (chain-unsupported) to dropped (location-unsupported)
• 932237 on Nginx: dropped (parameter-too-long) to dropped (matches-benign-traffic)
• 932180 on Apache (ModSecurity): dropped (chain-unsupported) to dropped (location-unsupported)
• 932237 on Apache (ModSecurity): approximate to dropped (matches-benign-traffic)
• 932180 on Traefik: dropped (chain-unsupported) to dropped (location-unsupported)
• 932237 on Traefik: approximate to dropped (location-unsupported)
• 932239 on Traefik: approximate to dropped (location-unsupported)
• 932180 on HAProxy: dropped (chain-unsupported) to dropped (location-unsupported)
• 932237 on HAProxy: approximate to dropped (matches-benign-traffic)
• 932180 on Envoy: dropped (chain-unsupported) to dropped (location-unsupported)
• 932237 on Envoy: approximate to dropped (matches-benign-traffic)

Added (7)

• 901360 (INITIALIZATION) @rx ^application/x-amz-json-1\.[01](?:\s*;.*)?$
• 901370 (INITIALIZATION) @rx ^(application/[a-z0-9.!#$&_^+-]+\+json)(?:\s*;.*)?$
• link 2 of 922100 (ATTACK) !@within %{tx.allowed_request_content_type_charset}
• 922160 (ATTACK) @gt 0
• 950020 (LEAKAGES) @pm gzip compress deflate br zstd
• 950022 (LEAKAGES) @eq 1
• update of 930120 (AFTER) !ARGS_NAMES:/^json\.profile[.\w\-]*$/

Removed (8)

• link 1 of 932180 (RCE) !@rx (?i)(?:\.boto|buddyinfo|mtrr|acpi|zoneinfo)\B
• 950010 (LEAKAGES) @pm gzip compress deflate br zstd
• 951010 (SQL) @pm gzip compress deflate br zstd
• 952010 (JAVA) @pm gzip compress deflate br zstd
• 953010 (PHP) @pm gzip compress deflate br zstd
• 954010 (IIS) @pm gzip compress deflate br zstd
• 955010 (SHELLS) @pm gzip compress deflate br zstd
• 956010 (RUBY) @pm gzip compress deflate br zstd

Changed (38)

• 920480 (ENFORCEMENT): transformations
• link 1 of 922100 (ATTACK): variables, operator !@Within %{tx.allowed_request_... to @unconditionalMatch, transformations
• 932125 (RCE): variables
• 932130 (RCE): variables
• 932140 (RCE): variables
• 932175 (RCE): variables
• 932180 (RCE): operator @pmFromFile restricted-upload.... to @rx (?i)(?:\b|^)(?:.(?:a(?:dd..., chain
• 932220 (RCE): variables
• 932230 (RCE): variables
• 932231 (RCE): variables
• 932232 (RCE): variables
• 932235 (RCE): variables, operator @rx (?i)(?:b["')[\x5c](?:(... to @rx (?i)(?:b["')[\x5c](?:(...
• 932236 (RCE): variables, operator @rx (?i)(?:^(?:json.|\x5c)?|b... to @rx (?i)(?:^(?:json.|\x5c)?|b...
• 932237 (RCE): variables, operator @rx (?i)\b(?:(?:7z[arx]?|(?:GE... to @rx (?i)\b(?:(?:7z[arx]?|(?:GE...
• 932238 (RCE): variables
• 932239 (RCE): variables, operator @rx (?i)(?:^(?:json.|\x5c)?|b... to @rx (?i)(?:^(?:json.|\x5c)?|b...
• 932240 (RCE): variables
• 932250 (RCE): variables
• 932260 (RCE): variables, operator @rx (?i)(?:^(?:json.|\x5c)?|b... to @rx (?i)(?:^(?:json.|\x5c)?|b...
• 932270 (RCE): variables, operator @rx +- to @rx (?:^|[\s\x0b$&(:->`|])...
• 932280 (RCE): variables
• 932281 (RCE): variables
• 932300 (RCE): variables
• 932301 (RCE): variables
• 932310 (RCE): variables
• and 13 more, in changes.json

The whole of it, per rule and per target, is in changes.json, attached to this release.

Backends

Quick install

curl -LO https://github.com/fabriziosalmi/patterns/releases/download/2026-10-18-crs-v4.30.0/nginx_waf.zip
unzip nginx_waf.zip -d /etc/nginx/waf_patterns

Integration guides → Nginx · Apache · Traefik · HAProxy · Envoy

What each target does with each rule

Of the 748 records in the CRS v4.30.0 intermediate representation, what each target does:

Why a record is dropped, by the first reason the backend found:

What a written rule loses, in how many of them:

The verdict for every rule and target is in coverage.json, attached to this release. How to read it.

Verify

This release is 2026-10-18-crs-v4.30.0, and it stays: releases are never deleted or replaced, so a link to this tag is a link to these files. Every file in it is signed by the workflow that built it, and attested. SHA256SUMS lists their hashes and is signed with the rest.

cosign verify-blob --bundle nginx_waf.zip.sigstore.json \
  --certificate-identity https://github.com/fabriziosalmi/patterns/.github/workflows/update_patterns.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nginx_waf.zip

Every step, and how to pin to a release.

SHA-256

08b7c1518dba3cecb55a62ab29d5f13d7d8c96f59fe7dafb7f1a142510773a3d  nginx_waf.zip
f424f4525d4b854aec67a1b67bc31fcaa5257aaee2ba844064036c04ec23e493  apache_waf.zip
c2282527e8f358cec06c791ed216bfa628b2eb42914e743f54eaa6a3db0ef199  traefik_waf.zip
cf097f7e43f1f32582e6e56ed18f65b34df8f84492195e9e49a1b3543bdb0722  haproxy_waf.zip
b4933093e833026c4b4c06ec30918409447d0539834aab40b6c7341c342e1276  envoy_waf.zip

echo "08b7c1518dba3cecb55a62ab29d5f13d7d8c96f59fe7dafb7f1a142510773a3d  nginx_waf.zip" | sha256sum -c -

Documentation · Source · Issues