All pull requests

Pull requests

• fix: accept SSN area numbers up to 899 in @verifySSN

  #3669·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

• fix: strip the trailing newline from the yajl error message

  #3668·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

• fix: accept any URI as the xmlns href

  #3667·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

• fix: do not close the GeoLookup database from ~ModSecurity

  #3666·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  3

• fix: let SecRuleUpdateActionById replace msg, logdata and severity

  #3665·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  5

• fix: do not copy the response body when SecResponseBodyAccess is Off

  #3664·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  3

• fix: show the negation in the operator match message

  #3663·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

• fix: only count real boundary parameters in the multipart C-T header

  #3662·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  5

• fix: apply ctl:ruleRemoveById to SecAction rules

  #3661·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  5

• fix: keep every netmask of an @ipMatch prefix in the radix tree

  #3660·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

• fix: run phase 2 rules when SecRequestBodyAccess is Off

  #3659·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  5

• fix: MULTIPART_UNMATCHED_BOUNDARY false positives

  2.x
  #3658·airween opened Oct 12, 2026Member·

  ·
  22

• fix: give internal error codes names and messages (multipart, Lua, ipMatch)

  #3657·fzipi opened Oct 12, 2026Collaborator·

  ·
  5

• fix: report failure when the rule parser throws

  3.x
  #3656·fzipi opened Oct 12, 2026Collaborator·

  ·
  4

  

• fix: MULTIPART_UNMATCHED_BOUNDARY is set to 2 for well-formed multipart bodies

  #3654·airween opened Oct 11, 2026Member·

  ·
  18

• Update CI workflow and remove duplicate Windows Server 2022 job

  #3653·Easton97-Jens opened Oct 3, 2026Contributor·

  ·
  12

• fix: set multipart flags on invalid C-D header, align tests

  2.x
  #3651·airween opened Oct 2, 2026Member·

  ·
  7

• V3/multipart part header errors

  3.x
  #3650·airween opened Oct 2, 2026Member·

  ·
  15

• Add opt-in escaping for textual RuleMessage logs

  3.x
  #3643·7acini opened Sep 27, 2026·

  ·
  15

• Create fopen_modsec

  #3640·AntonDemushkin opened Sep 21, 2026·

  ·
  6

• fix: rules-loading memory leaks on SecDefaultAction error paths and repeated msg/severity/logdata

  #3638·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Fix memory leak when SecGeoLookupDb loads a database more than once

  #3637·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Do not keep the @validateSchema parser errors in the operator

  #3636·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Fix memory leak in setvar when the current value is not numeric

  #3635·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Fix leak of the ARGS XML parser context on malformed documents

  #3633·tomsommer opened Sep 19, 2026Contributor·

  ·
  2