Patterns build · 2026-11-14
OWASP Core Rule Set coreruleset/coreruleset@v4.30.0 converted into native WAF rules for four web servers. Generated automatically; no manual edits.
Coverage: 748 patterns across 22 categories — SQLi, XSS, RCE, LFI, RFI, plus generic anomaly and protocol-violation rules.
What changed since the previous release
No rule changed since the previous release (CRS v4.30.0).
The whole of it, per rule and per target, is in changes.json, attached to this release.
Backends
| Backend | Format | Bots | Archive | Size |
|---|---|---|---|---|
| Nginx | map + if
| 1888 | nginx_waf.zip
| 56K |
| Apache | ModSecurity | 1888 | apache_waf.zip
| 88K |
| Traefik | Middleware TOML | 1888 | traefik_waf.zip
| 20K |
| HAProxy | Pattern files | 1888 | haproxy_waf.zip
| 80K |
| Envoy | RBAC filter | 1888 | envoy_waf.zip
| 88K |
Quick install
curl -LO https://github.com/fabriziosalmi/patterns/releases/download/2026-11-14-crs-v4.30.0/nginx_waf.zip
unzip nginx_waf.zip -d /etc/nginx/waf_patternsIntegration guides → Nginx · Apache · Traefik · HAProxy · Envoy
What each target does with each rule
Of the 748 records in the CRS v4.30.0 intermediate representation, what each target does:
| Target | Full | Approximate | Unsound | Dropped |
|---|---|---|---|---|
| Nginx | 11 | 159 | 0 | 578 |
| Apache (ModSecurity) | 8 | 171 | 0 | 569 |
| Traefik | 1 | 2 | 0 | 745 |
| HAProxy | 7 | 172 | 0 | 569 |
| Envoy | 7 | 176 | 0 | 565 |
Why a record is dropped, by the first reason the backend found:
| Reason | Nginx | Apache (ModSecurity) | Traefik | HAProxy | Envoy |
|---|---|---|---|---|---|
| an operator the backend cannot express | 294 | 294 | 294 | 294 | |
| matched on a request component the target does not have | 73 | 73 | 562 | 73 | 73 |
| part of a chain, and the target cannot require all of it | 127 | 127 | 127 | 127 | 127 |
| not a rule: it changes another rule | 55 | 55 | 55 | 55 | 55 |
| it refuses ordinary traffic once converted | 11 | 17 | 9 | 5 | |
| its severity is below what refuses, and the target cannot only record | 1 | 8 | 8 | ||
| longer than the target accepts | 15 | ||||
| it records and does not refuse | 3 | 3 | 3 | 3 |
What a written rule loses, in how many of them:
| Loss | Nginx | Apache (ModSecurity) | Traefik | HAProxy | Envoy |
|---|---|---|---|---|---|
| matched on other variables than the rule names | 153 | 166 | 2 | 172 | 176 |
| transformations the rule was written to run after are not applied | 122 | 121 | 2 | 120 | 124 |
The verdict for every rule and target is in coverage.json, attached to this release. How to read it.
Verify
This release is 2026-11-14-crs-v4.30.0, and it stays: releases are never deleted or replaced, so a link to this tag is a link to these files. Every file in it is signed by the workflow that built it, and attested. SHA256SUMS lists their hashes and is signed with the rest.
cosign verify-blob --bundle nginx_waf.zip.sigstore.json \
--certificate-identity https://github.com/fabriziosalmi/patterns/.github/workflows/update_patterns.yml@refs/heads/main \
--certificate-oidc-issuer https://token.actions.githubusercontent.com nginx_waf.zipEvery step, and how to pin to a release.
SHA-256
e3b2f4a786c9aaa34cd81916d442d86afc42c43ac81e667e6de97e345e1e5b5d nginx_waf.zip
c15e9c583d6d9ee40f41203d8670f1e15e3dfb3aa8cc76234d65d2baca62f48a apache_waf.zip
a0819b815036ebf35a688305f41ec20c30c639972be0bf2075efb51e5252bcab traefik_waf.zip
c8879d222f3d4a2695a8247c3867faf426d515a5ba139d5a510574cc440fb3b3 haproxy_waf.zip
bd223f19b6d9846439c592d240f96c84bb87cb584dfa12c1fb237ebb46a3c96d envoy_waf.zip
echo "e3b2f4a786c9aaa34cd81916d442d86afc42c43ac81e667e6de97e345e1e5b5d nginx_waf.zip" | sha256sum -c -