CVE-2026-62971 · Package
NO FIX YET · SEE WHAT TO DO
The OWASP Core Rule Set's XML rules inspect only element text and skip attribute values, so attack payloads placed in XML attributes pass through unchecked. An attacker can send SQL injection, XSS or other attack strings in XML attributes to bypass the firewall's detection.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites and APIs that run the OWASP Core Rule Set in a web application firewall and accept XML request bodies are exposed, since the XML inspection expression misses attribute values in the 921 to 943 rule families. Installations that do not use CRS, do not accept XML, or run only the 944 Java rules are not affected by this flaw.
Not affected if java-rules-only, no-xml-requests, non-crs-waf
Who cares apache, modsecurity, nginx, owasp-crs, waf, xml-api
cat REQUEST-901-INITIALIZATION.conf or the package version in your dependency file.3.3.10, 4.25.1, and 4.28.0 contain the patch; upgrade the branch you run to one of these.The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/. That expression matches only element text nodes — it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href="javascript:alert(1)=window.name"></a> or <a value="' OR 1=1 --"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@ in addition to XML:/* and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.