{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-62971/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:owasp:core_rule_set:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-62971"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Core Rule Set (\u003c 3.3.10, 4.25.1, 4.28.0)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-62971","web-application-firewall","defense-evasion","vulnerability"],"_cs_type":"advisory","_cs_vendors":["OWASP"],"content_html":"\u003cp\u003eVersions of the OWASP Core Rule Set (CRS) prior to 3.3.10, 4.25.1, and 4.28.0 contain a vulnerability (CVE-2026-62971) where XML request body inspection is limited to text nodes via the XPath expression XML:/\u003cem\u003e. This limitation causes the CRS to ignore malicious payloads embedded within XML attributes, effectively bypassing detection rules across nine rule families: 921 (Protocol Attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (Generic), 941 (XSS), 942 (SQLi), and 943 (Session Fixation). The 944 (Java) family is unaffected as it correctly includes the XML://@\u003c/em\u003e attribute path.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAttackers can bypass WAF protections for common web attack vectors (SQLi, XSS, RCE, etc.) by crafting payloads that reside in XML attributes, potentially leading to unauthenticated compromise of backend applications protected by vulnerable CRS versions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the OWASP Core Rule Set to version 3.3.10, 4.25.1, or 4.28.0 immediately to include proper XML attribute inspection.\u003c/li\u003e\n\u003cli\u003eFor environments unable to patch immediately, implement additional WAF rules or backend application-level validation to specifically inspect incoming XML attribute values for malicious content.\u003c/li\u003e\n\u003cli\u003eAudit existing WAF logging for XML traffic patterns to determine if legacy configurations or bypass attempts are present.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T20:06:54Z","date_published":"2026-11-11T20:06:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-owasp-crs-bypass-cve-2026-62971/","summary":"The OWASP Core Rule Set (CRS) fails to inspect XML attribute values due to limited XPath coverage, allowing attackers to bypass critical web application firewall detection rules by embedding payloads within XML attributes.","title":"OWASP Core Rule Set: XML attribute bypass (CVE-2026-62971)","url":"https://feed.craftedsignal.io/briefs/2026-11-owasp-crs-bypass-cve-2026-62971/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-62971","version":"https://jsonfeed.org/version/1.1"}