CVE-2026-62971

Name of the Vulnerable Software and Affected Versions OWASP Core Rule Set versions prior to 3.3.10 OWASP Core Rule Set versions prior to 4.25.1 OWASP Core Rule Set versions prior to 4.28.0

Description Certain rule families (921, 930, 931, 932, 933, 934, 941, 942, and 943) inspect XML request bodies using the XPath expression XML:/*. This expression only matches element text nodes and fails to match XML attribute values. Consequently, an attacker can bypass detection by placing a payload within an XML attribute. This issue affects approximately 159 rules across 9 rule files and persists across all paranoia levels (PL1 through PL4).

Recommendations Update to version 3.3.10 or later. Update to version 4.25.1 or later. Update to version 4.28.0 or later.