Coreruleset vulnerabilities
We track 3 vulnerabilities in Coreruleset products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest Coreruleset vulnerabilities
- 7.2 High severity
coreruleset: Improper Neutralization of Special Elements
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (g
- 8.8 High severity
coreruleset: Inefficient Regular Expression Complexity
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used
- 7.5 High severity
coreruleset: Improper Handling of Case Sensitivity
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .p