OWASP Core Rule Set: XML attribute bypass (CVE-2026-62971)
The OWASP Core Rule Set (CRS) fails to inspect XML attribute values due to limited XPath coverage, allowing attackers to bypass critical web application firewall detection rules by embedding payloads within XML attributes.
CVE search metadata
CVE search record: CVE-2026-62971. Severity: high. CVSS: 7.2. KEV: no. Product: Core Rule Set (< 3.3.10, 4.25.1, 4.28.0). Brief: OWASP Core Rule Set: XML attribute bypass (CVE-2026-62971). Brief link: https://feed.craftedsignal.io/briefs/2026-11-owasp-crs-bypass-cve-2026-62971/
Triage facts
Revision 1- Applicability
- Core Rule Set (< 3.3.10, 4.25.1, 4.28.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 20:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Versions of the OWASP Core Rule Set (CRS) prior to 3.3.10, 4.25.1, and 4.28.0 contain a vulnerability (CVE-2026-62971) where XML request body inspection is limited to text nodes via the XPath expression XML:/. This limitation causes the CRS to ignore malicious payloads embedded within XML attributes, effectively bypassing detection rules across nine rule families: 921 (Protocol Attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (Generic), 941 (XSS), 942 (SQLi), and 943 (Session Fixation). The 944 (Java) family is unaffected as it correctly includes the XML://@ attribute path.
Impact
Attackers can bypass WAF protections for common web attack vectors (SQLi, XSS, RCE, etc.) by crafting payloads that reside in XML attributes, potentially leading to unauthenticated compromise of backend applications protected by vulnerable CRS versions.
Recommendation
- Update the OWASP Core Rule Set to version 3.3.10, 4.25.1, or 4.28.0 immediately to include proper XML attribute inspection.
- For environments unable to patch immediately, implement additional WAF rules or backend application-level validation to specifically inspect incoming XML attribute values for malicious content.
- Audit existing WAF logging for XML traffic patterns to determine if legacy configurations or bypass attempts are present.
Immediate actions
Update CRS to 3.3.10, 4.25.1, or 4.28.0
Threat Hunt
Investigate XML traffic logs for payloads in XML attributes where standard WAF rules failed to alert
Data: WAF request logs, Web server raw request logs
Mitigations
Upgrade to CRS 3.3.10, 4.25.1, or 4.28.0
CVE-2026-62971