WAF - WAF Release - 2026-10-06

<p>This release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.</p> <p><strong>Key Findings</strong></p> <ul> <li>CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP. Attackers can exploit this flaw to execute arbitrary code on the affected system.</li> </ul> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="e6fd9291701d4fea96741ba1a056caff"><button type="button" title="Copy rule ID" aria-label="Copy rule ID e6fd9291701d4fea96741ba1a056caff" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...a056caff</span></button></span></td><td>N/A</td><td>Command Injection - Generic 8 - uri - Beta</td><td>Log</td><td>Block</td><td>This rule is merged into the original rule &quot;Command Injection - Generic 8 - uri&quot; (ID: <span class="rule-id" data-rule-id="ff8df24181aa4573a81be531ee159e2e"><button type="button" title="Copy rule ID" aria-label="Copy rule ID ff8df24181aa4573a81be531ee159e2e" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...ee159e2e</span></button></span>).</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="f0c31de76290471e842c77ca7206c737"><button type="button" title="Copy rule ID" aria-label="Copy rule ID f0c31de76290471e842c77ca7206c737" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...7206c737</span></button></span></td><td>N/A</td><td>F5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="86b0681d72234ef7bd6f67c7549f7356"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 86b0681d72234ef7bd6f67c7549f7356" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...549f7356</span></button></span></td><td>N/A</td><td>Next.js - Cache Poisoning - CVE:CVE-2026-94543</td><td>Block</td><td>Block</td><td>Rule metadata description refined. Detection unchanged.</td></tr></tbody></table>