Patterns build · 2026-10-19
OWASP Core Rule Set coreruleset/coreruleset@v4.30.0 converted into native WAF rules for four web servers. Generated automatically; no manual edits.
Coverage: 748 patterns across 22 categories — SQLi, XSS, RCE, LFI, RFI, plus generic anomaly and protocol-violation rules.
What changed since the previous release
No rule changed since the previous release (CRS v4.30.0).
The whole of it, per rule and per target, is in changes.json, attached to this release.
Backends
| Backend | Format | Bots | Archive | Size |
|---|---|---|---|---|
| Nginx | map + if
| 1869 | nginx_waf.zip
| 52K |
| Apache | ModSecurity | 1869 | apache_waf.zip
| 84K |
| Traefik | Middleware TOML | 1869 | traefik_waf.zip
| 20K |
| HAProxy | Pattern files | 1869 | haproxy_waf.zip
| 80K |
| Envoy | RBAC filter | 1869 | envoy_waf.zip
| 88K |
Quick install
curl -LO https://github.com/fabriziosalmi/patterns/releases/download/2026-10-19-crs-v4.30.0/nginx_waf.zip
unzip nginx_waf.zip -d /etc/nginx/waf_patternsIntegration guides → Nginx · Apache · Traefik · HAProxy · Envoy
What each target does with each rule
Of the 748 records in the CRS v4.30.0 intermediate representation, what each target does:
| Target | Full | Approximate | Unsound | Dropped |
|---|---|---|---|---|
| Nginx | 11 | 159 | 0 | 578 |
| Apache (ModSecurity) | 8 | 171 | 0 | 569 |
| Traefik | 1 | 2 | 0 | 745 |
| HAProxy | 7 | 172 | 0 | 569 |
| Envoy | 7 | 176 | 0 | 565 |
Why a record is dropped, by the first reason the backend found:
| Reason | Nginx | Apache (ModSecurity) | Traefik | HAProxy | Envoy |
|---|---|---|---|---|---|
| an operator the backend cannot express | 294 | 294 | 294 | 294 | |
| matched on a request component the target does not have | 73 | 73 | 562 | 73 | 73 |
| part of a chain, and the target cannot require all of it | 127 | 127 | 127 | 127 | 127 |
| not a rule: it changes another rule | 55 | 55 | 55 | 55 | 55 |
| it refuses ordinary traffic once converted | 11 | 17 | 9 | 5 | |
| its severity is below what refuses, and the target cannot only record | 1 | 8 | 8 | ||
| longer than the target accepts | 15 | ||||
| it records and does not refuse | 3 | 3 | 3 | 3 |
What a written rule loses, in how many of them:
| Loss | Nginx | Apache (ModSecurity) | Traefik | HAProxy | Envoy |
|---|---|---|---|---|---|
| matched on other variables than the rule names | 153 | 166 | 2 | 172 | 176 |
| transformations the rule was written to run after are not applied | 122 | 121 | 2 | 120 | 124 |
The verdict for every rule and target is in coverage.json, attached to this release. How to read it.
Verify
This release is 2026-10-19-crs-v4.30.0, and it stays: releases are never deleted or replaced, so a link to this tag is a link to these files. Every file in it is signed by the workflow that built it, and attested. SHA256SUMS lists their hashes and is signed with the rest.
cosign verify-blob --bundle nginx_waf.zip.sigstore.json \
--certificate-identity https://github.com/fabriziosalmi/patterns/.github/workflows/update_patterns.yml@refs/heads/main \
--certificate-oidc-issuer https://token.actions.githubusercontent.com nginx_waf.zipEvery step, and how to pin to a release.
SHA-256
32d53f6a39f76c89d0e32dd789989f0f285a8211f673ad0af12e4c1ac549792d nginx_waf.zip
8237c83dafd154ab85b55025c12d3239cfdb773cbc1913c607ae9f8dd5cc8e27 apache_waf.zip
69cbe75949f7f9a1e0541e4fc37d06b149cfe1fb510e7338ed3dc461951e34df traefik_waf.zip
784648a9881fcd25ffc5d51d68e3d84a011e88b6ce3e51016097540915c8febb haproxy_waf.zip
3e4a97cec74ea23cc98133024dce15140ac7ade689cb70d45c7a64715a0145f3 envoy_waf.zip
echo "32d53f6a39f76c89d0e32dd789989f0f285a8211f673ad0af12e4c1ac549792d nginx_waf.zip" | sha256sum -c -