Web Application Firewall Vulnerability in OWASP Core Rule Set

CVE-2026-62971

What is CVE-2026-62971?

The OWASP Core Rule Set (CRS) possesses a significant vulnerability impacting its ability to detect certain attack payloads embedded within XML attribute values. The issue arises from the use of the XPath expression XML:/*, which only matches element text nodes, thereby allowing adversaries to bypass detection when an attack is situated within an XML attribute (for example, ). This flaw affects approximately 159 rules across nine specific rule files at all paranoia levels (PL1 through PL4), compromising the effectiveness of the firewall in identifying various attack types including protocol attacks, local file inclusions, remote file inclusions, and cross-site scripting among others. Notably, the 944 (Java) family rule set is not impacted due to its correct handling of XML attributes. This issue has been addressed in recent updates to the CRS.

References