All pull requests

Pull requests

• fix: do not let !@rx and !@rxGlobal match on a regex error

  3.x
  #3700·fzipi opened Oct 16, 2026Collaborator·

  ·
  1

  2

• fix: make setvar =+N / =-N an atomic update in the collection backend

  3.x
  #3699·fzipi opened Oct 16, 2026Collaborator·

  ·
  1

  4

• fix: do not log multiMatch chain starters before the chain completes

  3.x
  #3698·fzipi opened Oct 16, 2026Collaborator·

  ·
  1

  2

• refactor: extract the UTF-8 sequence decoder from utf8_unicode_inplace_ex (2.x)

  2.xrefactor
  #3697·fzipi opened Oct 15, 2026Collaborator·

  ·
  2

• iis: use raw HTTP verb for unknown methods such as PATCH

  2.xPlatform - IIS
  #3693·A13501350 opened Oct 15, 2026·

  ·
  2

• perf: drop redundant exclusion check in rule evaluation

  3.x
  #3692·chweidling opened Oct 15, 2026·

  ·
  2

• perf: evaluate tags without macros only once

  3.x
  #3691·chweidling opened Oct 15, 2026·

  ·
  2

• IIS: preserve duplicate request/response headers with same name

  2.x
  #3690·A13501350 opened Oct 14, 2026·

  ·
  4

• IIS: propagate Location header on redirect interventions

  2.x
  #3689·A13501350 opened Oct 14, 2026·

  ·
  4

• fix: pair curl_global_init with curl_global_cleanup on reload

  2.x
  #3682·fzipi opened Oct 13, 2026Collaborator·

  ·
  2

• v2: surface libxml2's parse error in REQBODY_ERROR_MSG and silence its stderr output

  2.x
  #3681·fzipi opened Oct 13, 2026Collaborator·

  ·
  2

• feat: surface libxml2's parse error in REQBODY_ERROR_MSG

  3.x
  #3679·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

  

• fix: silence libxml2 parser errors on every libxml2 version

  3.x
  #3677·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

• fix: close the read end of piped logs in every child

  2.x
  #3676·fzipi opened Oct 13, 2026Collaborator·

  ·
  2

• fix: name the multipart Content-Disposition error codes and return 0 from m.setvar (2.x)

  2.x
  #3675·fzipi opened Oct 13, 2026Collaborator·

  ·
  2

• fix: provide ap_map_http_request_error for the standalone build

  #3674·fzipi opened Oct 13, 2026Collaborator·

  ·
  2

• fix: register the regex pool cleanup right after a successful compile

  #3673·fzipi opened Oct 13, 2026Collaborator·

  ·
  2

• fix: accept SSN area numbers up to 899 in @verifySSN (2.x)

  #3672·fzipi opened Oct 13, 2026Collaborator·

  ·
  2

• fix: keep every netmask of an @ipMatch prefix in the radix tree (2.x)

  #3671·fzipi opened Oct 13, 2026Collaborator·

  ·
  2

• fix: read the request body back from disk in modsecurity_request_body_end_raw

  #3670·fzipi opened Oct 13, 2026Collaborator·

  ·
  2

• fix: accept SSN area numbers up to 899 in @verifySSN

  #3669·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

• fix: strip the trailing newline from the yajl error message

  #3668·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

• fix: accept any URI as the xmlns href

  #3667·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  2

• fix: do not close the GeoLookup database from ~ModSecurity

  #3666·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  7

• fix: let SecRuleUpdateActionById replace msg, logdata and severity

  #3665·fzipi opened Oct 13, 2026Collaborator·

  ·
  1

  7