All issues

Concurrent ctl:ruleRemoveTargetById removals overwrite each other (data race on Exceptions)

#1723

· rforced opened

on Sep 29, 2026

redirect/drop disruptive actions on the request phase are silently downgraded to 200 in the net/http connector

#1718

· fzipi opened

on Sep 22, 2026

net/http integration: drop/redirect interruption actions fall through to default 200 OK (docs/capability gap)

#1717

· kta1kri opened

on Sep 20, 2026

Implement RESPONSE_XML support

#1714

· fzipi opened

on Sep 3, 2026

URLENCODED_ERROR is never set for the condition it documents; the decoder cannot detect it

#1696

· fzipi opened

on Aug 28, 2026

15 MULTIPART_* variables are declared but never populated, so rules referencing them silently never match

#1687

· fzipi opened

on Aug 24, 2026

Concurrent audit log writer: transaction ID is unsanitized in the audit record file path

#1686

· fzipi opened

on Aug 24, 2026

REQUEST_BODY is not populated when a body processor ran (XML/JSON), diverging from libmodsecurity v3

#1685

· fzipi opened

on Aug 19, 2026

Transformation cache misses on map-backed collections

#1681

· M4tteoP opened

on Aug 12, 2026

`msg`/`logdata` macros are expanded on every rule evaluation, emitting spurious "key not found in collection" warnings

#1675

· blotus opened

on Jul 28, 2026

cookieParser misinterepretaion of unicode cookie values

#1674

· HackingRepo opened

on Jul 28, 2026

jsDecode confusion in some cases

#1668

· HackingRepo opened

on Jul 26, 2026