Owner

coreruleset

26 indexed repositories · View on GitHub

coreruleset
OWASP CRS (Official Repository)

Python · 3269 stars
modsecurity-crs-docker
Official ModSecurity Docker + Core Rule Set (CRS) images

Dockerfile · 448 stars
go-ftw
Web Application Firewall Testing Framework - Go version

Go · 182 stars
plugin-registry
Registry for OWASP CRS plugins, official and 3rd party

Python · 53 stars
nextcloud-rule-exclusions-plugin
Rule exclusion plugin for Nextcloud

45 stars
wordpress-rule-exclusions-plugin
Rule exclusion plugin for WordPress.

33 stars
secrules_parsing
A parser for the SecRules Langue

Python · 23 stars
coraza-crs-docker
Coraza, CRS and Apache/Caddy/Nginx

Shell · 15 stars
crs-toolchain
The Swiss army knife for CRS developers

Go · 14 stars
fake-bot-plugin
This is a plugin that brings blocking of bots faking User-Agent to CRS.

Lua · 14 stars
crslang
The next generation CRS language

Go · 12 stars
project-seaweed
Testing CVEs against CRS

Go · 10 stars
albedo
HTTP reflector and black hole

Go · 7 stars
documentation
CRS Documentation

JavaScript · 6 stars
drupal-rule-exclusions-plugin
Rule exclusion plugin for Drupal

5 stars
crs-linter
Rules checker and linter for the CRS project

Python · 4 stars
seclang_parser
ANTLR based SecLang parser

Python · 4 stars
ftw-tests-schema
FTW Testing YAML Schema Definition

Go · 1 star
body-decompress-plugin
This is a plugin that brings on-the-fly decompression of RESPONSE_BODY to CRS.

Lua · 1 star
phpmyadmin-rule-exclusions-plugin
Rule exclusion plugin for phpMyAdmin.

1 star
6 more repositories live on View on GitHub

Beginner friendly Everything

Open All

feat: Should we make ftp_ssl_connect same as ftp_connect trigger at PL1 high risk php function? Open

:+1: Feature Request

Difficulty 2/5 1-3 hours Newbie friendliness 58/100

coreruleset/coreruleset#4804 · Opened Sep 15, 2026
Response body "skip if compressed" guards defeat body-decompress-plugin Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

coreruleset/body-decompress-plugin#18 · 2 comments · Opened Sep 14, 2026
document rule-range support across engines Open

coreruleset/documentation#301 · 1 reaction · 2 assignees · Opened Sep 14, 2026
Dependency Dashboard Open

Difficulty 1/5 Under an hour Newbie friendliness 75/100

coreruleset/coderabbit#3 · Opened Sep 13, 2026
update tests to match upstream coreruleset Open

coreruleset/crs-linter#165 · 1 reaction · 2 assignees · Opened Sep 12, 2026
XSS Filter Evasion via Named HTML Entity Line Breaks and JS Label Syntax at PL3 Open

:heavy_minus_sign: False Negative - Evasion

Difficulty 4/5 3-5 days Newbie friendliness 52/100

coreruleset/coreruleset#4797 · 2 comments · Opened Sep 10, 2026
owasp crs sandbox have TRACE enabled in apache Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

coreruleset/modsecurity-crs-docker#473 · 3 comments · Opened Sep 8, 2026
Command Injection Possible in some cases it depends from PL1 to PL3 Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

coreruleset/coreruleset#4790 · 5 comments · Opened Sep 8, 2026
Shell control structures might help evading RCE rules Open

:heavy_minus_sign: False Negative - Evasion

Difficulty 4/5 3-5 days Newbie friendliness 42/100

coreruleset/coreruleset#4789 · 16 comments · Opened Sep 8, 2026
False Positive at PL1 with the word "builtin" Open

:heavy_plus_sign: False Positive

Difficulty 3/5 1-2 days Newbie friendliness 68/100

coreruleset/coreruleset#4788 · 1 comment · Opened Sep 8, 2026
Validate registry.yaml's license field against real SPDX identifiers Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

coreruleset/plugin-registry#49 · Opened Sep 7, 2026
EU CRA vulnerability reporting duty for commercial OWASP CRS integrators Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

coreruleset/coreruleset#4785 · 1 reaction · Opened Sep 7, 2026
Legitimate User Agents like AppleTV6,2/11.1 blocked in PL2 Open

:heavy_plus_sign: False Positive

Difficulty 3/5 1-2 days Newbie friendliness 68/100

coreruleset/coreruleset#4783 · 1 comment · Opened Sep 7, 2026
A duplicate special sandbox headers will lead to an internal server error in CRS sandbox and also some http versions Open

:bug: bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

coreruleset/coreruleset#4782 · 3 comments · Opened Sep 7, 2026
Monthly Chat Agenda September 2026 (2026-09-07) Open

:bookmark: Meeting Agenda

Difficulty 3/5 1-2 days Newbie friendliness 45/100

coreruleset/coreruleset#4781 · 1 comment · Opened Sep 7, 2026
feat: add plugin install command Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

coreruleset/crs-toolchain#328 · Opened Aug 21, 2026
feat: reusable workflow to attest plugin release artifacts Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

coreruleset/actions#3 · 1 comment · Opened Aug 21, 2026
feat: install CRS plugins at container start from the plugin registry Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 28/100

coreruleset/modsecurity-crs-docker#470 · 1 comment · Opened Aug 20, 2026
XXE: the entity declaration is not present in any variable CRS rules target Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

coreruleset/coreruleset#4767 · 4 comments · Opened Aug 19, 2026
restricted-files.data covers files but not framework management endpoints Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

coreruleset/coreruleset#4766 · 1 comment · Opened Aug 19, 2026
Detect WordPress plugin/theme metadata enumeration (readme.txt and friends) Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

coreruleset/coreruleset#4765 · 9 comments · Opened Aug 19, 2026
feat: add util new-unused-id to find the next free rule ID Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

coreruleset/crs-toolchain#327 · Opened Aug 17, 2026
Invalid requests are silently dropped Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

coreruleset/go-ftw#662 · Opened Aug 17, 2026
FP 932237: two-letter shell commands match browser User-Agent locale tags (es-es, nl-nl) at PL3 Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

coreruleset/coreruleset#4761 · 1 comment · Opened Aug 16, 2026
Unlock the remaining flow gates: 194 CVEs are never exercised Open

Difficulty 5/5 Over a week Newbie friendliness 42/100

coreruleset/project-seaweed#162 · 2 comments · Opened Aug 16, 2026
Integer MAX value is recognised as malicius Open

:heavy_plus_sign: False Positive

Difficulty 3/5 1-2 days Newbie friendliness 68/100

coreruleset/coreruleset#4754 · 2 comments · Opened Aug 7, 2026
Rule 932160 blocks submitting URLs containing /cgi-bin/show.pl Open

:heavy_plus_sign: False Positive

coreruleset/coreruleset#4753 · 2 comments · 1 assignee · Opened Aug 6, 2026
feat: keyless (cosign/Sigstore) signing as GPG replacement for release artifacts Open

:+1: Feature Request

Difficulty 5/5 Over a week Newbie friendliness 45/100

coreruleset/coreruleset#4751 · 3 comments · Opened Aug 3, 2026
Content type application/x-amz-json-1.1 is not included in default configuration Open

:book: documentation

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

coreruleset/coreruleset#4734 · 2 comments · Opened Jul 21, 2026
Serious Backtick MySQL sqli payloads not detected from PL1 to PL3 Open

:heavy_minus_sign: False Negative - Evasion

Difficulty 3/5 1-2 days Newbie friendliness 48/100

coreruleset/coreruleset#4733 · 4 comments · Opened Jul 20, 2026
One SSTI payload left undetected from PL1 to PL3 Open

:heavy_minus_sign: False Negative - Evasion

Difficulty 4/5 3-5 days Newbie friendliness 48/100

coreruleset/coreruleset#4732 · 2 comments · Opened Jul 20, 2026
feat: Detect SOAP/JAX-WS ThreadLocal Authentication Bypass Open

:+1: Feature Request

Difficulty 5/5 Over a week Newbie friendliness 35/100

coreruleset/coreruleset#4731 · 1 comment · Opened Jul 20, 2026
SQLi detection bypass via single-pass percent-encoded SQL syntax Open

:heavy_minus_sign: False Negative - Evasion

Difficulty 4/5 3-5 days Newbie friendliness 45/100

coreruleset/coreruleset#4722 · 2 comments · Opened Jul 19, 2026
Replace `^` and `$` with `\A` and `\z` respectively Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

coreruleset/coreruleset#4706 · 3 comments · Opened Jul 15, 2026
An attacker can overwrite critical files using the `>`, wildcards and ? allowed, means an attacker will overwrites existent files or use it to extract exit code Open

:heavy_minus_sign: False Negative - Evasion

Difficulty 4/5 3-5 days Newbie friendliness 35/100

coreruleset/coreruleset#4699 · 4 comments · Opened Jul 5, 2026
feat: Detect JWT `alg:none` attack Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

coreruleset/coreruleset#4662 · 1 comment · Opened Jun 10, 2026
Config Split, exclude Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

coreruleset/drupal-rule-exclusions-plugin#16 · Opened May 20, 2026
perf: rule 941170 moz-binding branch regex slower than v3.3 (1.4–2.5× PCRE regression) Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

coreruleset/coreruleset#4633 · 7 comments · Opened May 8, 2026
Make "dynamic tests" a feature of go-ftw Open

coreruleset/ftw-tests-schema#62 · 1 comment · 1 reaction · 2 assignees · Opened Apr 30, 2026
RFC: CRS Access Control Dimensions - Design Exploration Open

:bulb: ideas

Difficulty 5/5 Over a week Newbie friendliness 25/100

coreruleset/coreruleset#4615 · 1 reaction · Opened Apr 16, 2026
Rule 932180 FP on "ultrasound" in Filename Open

:heavy_plus_sign: False Positive

coreruleset/coreruleset#4602 · 8 comments · 1 assignee · Opened Apr 1, 2026
CVE-derived payload research: FP reductions and FN improvements Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

coreruleset/coreruleset#4584 · 3 comments · Opened Mar 30, 2026
Rules for AI Crawlers Open

enhancement help wanted

Difficulty 5/5 Over a week Newbie friendliness 35/100

coreruleset/plugin-registry#44 · 10 comments · Opened Mar 5, 2026
Switch apache debian image to hardened image Open

coreruleset/modsecurity-crs-docker#412 · 2 comments · 2 reactions · 2 assignees · Opened Mar 1, 2026
Create httpd fingerprinting detection plugin Open

enhancement help wanted

Difficulty 5/5 Over a week Newbie friendliness 35/100

coreruleset/plugin-registry#43 · 1 comment · Opened Feb 28, 2026
Move Collabora Online rule exclusions to it's own plugin Open

coreruleset/nextcloud-rule-exclusions-plugin#146 · 1 comment · 1 assignee · Opened Feb 28, 2026
Add a version suitable for plugins Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

coreruleset/crs-linter#135 · 1 comment · Opened Feb 19, 2026
Dependency Dashboard Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

coreruleset/secrules_parsing#107 · Opened Feb 8, 2026
Review Cache-Control/Expires headers and check attacks Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

coreruleset/coreruleset#4444 · Opened Feb 5, 2026
Deny double URL decoding Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

coreruleset/crs-linter#124 · Opened Jan 29, 2026

Showing the newest 100

This page lists what was indexed most recently. Advanced filter has the whole inventory, narrowed by language, difficulty and how long a task takes.

Open advanced filter

coreruleset

Showing the newest 100

Get new issues in your inbox