WAF - WAF Release - 2026-09-22

<p>This release introduces new threat detections to enhance protection against Server-Side Request Forgery (SSRF) attempts using non-standard IP notations or jar loopback payloads, alongside new defenses against Server-Side Template Injection (SSTI) targeting Jinja environments.</p> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="ca05d6c847834f75a317c33b5f21b651"><button type="button" title="Copy rule ID" aria-label="Copy rule ID ca05d6c847834f75a317c33b5f21b651" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...5f21b651</span></button></span></td><td>N/A</td><td>SSRF - Cloud,Link-Local non-standard IP notation</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="40b93de7a8f848709c4ec3e60f0313d6"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 40b93de7a8f848709c4ec3e60f0313d6" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...0f0313d6</span></button></span></td><td>N/A</td><td>SSRF - Block jar HTTP loopback payload</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="48dfa3e5bef84063914edfe175cd912a"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 48dfa3e5bef84063914edfe175cd912a" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...75cd912a</span></button></span></td><td>N/A</td><td>SSRF - Local non-standard IP notation</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="cd1de1fd21c443508f9073f2a1ba83f6"><button type="button" title="Copy rule ID" aria-label="Copy rule ID cd1de1fd21c443508f9073f2a1ba83f6" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...a1ba83f6</span></button></span></td><td>N/A</td><td>SSTI - Jinja Dangerous Globals Chain</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr></tbody></table>