Patterns build · 2026-11-04
OWASP Core Rule Set coreruleset/coreruleset@v4.30.0 converted into native WAF rules for four web servers. Generated automatically; no manual edits.
Coverage: 748 patterns across 22 categories — SQLi, XSS, RCE, LFI, RFI, plus generic anomaly and protocol-violation rules.
What changed since the previous release
No rule changed since the previous release (CRS v4.30.0).
The whole of it, per rule and per target, is in changes.json, attached to this release.
Backends
| Backend | Format | Bots | Archive | Size |
|---|---|---|---|---|
| Nginx | map + if
| 1871 | nginx_waf.zip
| 52K |
| Apache | ModSecurity | 1871 | apache_waf.zip
| 84K |
| Traefik | Middleware TOML | 1871 | traefik_waf.zip
| 20K |
| HAProxy | Pattern files | 1871 | haproxy_waf.zip
| 80K |
| Envoy | RBAC filter | 1871 | envoy_waf.zip
| 88K |
Quick install
curl -LO https://github.com/fabriziosalmi/patterns/releases/download/2026-11-04-crs-v4.30.0/nginx_waf.zip
unzip nginx_waf.zip -d /etc/nginx/waf_patternsIntegration guides → Nginx · Apache · Traefik · HAProxy · Envoy
What each target does with each rule
Of the 748 records in the CRS v4.30.0 intermediate representation, what each target does:
| Target | Full | Approximate | Unsound | Dropped |
|---|---|---|---|---|
| Nginx | 11 | 159 | 0 | 578 |
| Apache (ModSecurity) | 8 | 171 | 0 | 569 |
| Traefik | 1 | 2 | 0 | 745 |
| HAProxy | 7 | 172 | 0 | 569 |
| Envoy | 7 | 176 | 0 | 565 |
Why a record is dropped, by the first reason the backend found:
| Reason | Nginx | Apache (ModSecurity) | Traefik | HAProxy | Envoy |
|---|---|---|---|---|---|
| an operator the backend cannot express | 294 | 294 | 294 | 294 | |
| matched on a request component the target does not have | 73 | 73 | 562 | 73 | 73 |
| part of a chain, and the target cannot require all of it | 127 | 127 | 127 | 127 | 127 |
| not a rule: it changes another rule | 55 | 55 | 55 | 55 | 55 |
| it refuses ordinary traffic once converted | 11 | 17 | 9 | 5 | |
| its severity is below what refuses, and the target cannot only record | 1 | 8 | 8 | ||
| longer than the target accepts | 15 | ||||
| it records and does not refuse | 3 | 3 | 3 | 3 |
What a written rule loses, in how many of them:
| Loss | Nginx | Apache (ModSecurity) | Traefik | HAProxy | Envoy |
|---|---|---|---|---|---|
| matched on other variables than the rule names | 153 | 166 | 2 | 172 | 176 |
| transformations the rule was written to run after are not applied | 122 | 121 | 2 | 120 | 124 |
The verdict for every rule and target is in coverage.json, attached to this release. How to read it.
Verify
This release is 2026-11-04-crs-v4.30.0, and it stays: releases are never deleted or replaced, so a link to this tag is a link to these files. Every file in it is signed by the workflow that built it, and attested. SHA256SUMS lists their hashes and is signed with the rest.
cosign verify-blob --bundle nginx_waf.zip.sigstore.json \
--certificate-identity https://github.com/fabriziosalmi/patterns/.github/workflows/update_patterns.yml@refs/heads/main \
--certificate-oidc-issuer https://token.actions.githubusercontent.com nginx_waf.zipEvery step, and how to pin to a release.
SHA-256
59fa1e87d26ffc5612e9c1cd3e5ee3f9dec7ea6ba9f7febd09bd9bf59138ae3a nginx_waf.zip
792af847af133c89ef7ddc9619960fdb5b12ae9970202f30ea21d7683b6f9bdb apache_waf.zip
b55448380ce5559888df0bb33c8f7d038b4573c8659914e022dd4cf67b4c74ea traefik_waf.zip
b571404dbde649f286f108ab012f40cb925f89dab9cd435a00518a988b3e5c83 haproxy_waf.zip
cf30da09c43fcc24eb2c6620f9971d4954ae0c76ab17b65b722a61160d28f902 envoy_waf.zip
echo "59fa1e87d26ffc5612e9c1cd3e5ee3f9dec7ea6ba9f7febd09bd9bf59138ae3a nginx_waf.zip" | sha256sum -c -