CVE-2026-62971

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/*. That expression matches only element text nodes — it does not match XML attribute values…

11. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-62971