CVE-2026-62971: OWASP CRS: XML Attribute Value Bypass
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/. That expression matches only element text nodes — it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href="javascript:alert(1)=window.name"></a> or <a value="' OR 1=1 --"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@ in addition to XML:/ and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OWASP CRSto a version that resolves this vulnerability.Fixed in 3.3.10 - Upgrade
Upgrade
OWASP CRSto a version that resolves this vulnerability.Fixed in 4.25.1 - Upgrade
Upgrade
OWASP CRSto a version that resolves this vulnerability.Fixed in 4.28.0
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using OWASP CRS versions earlier than 3.3.10, 4.25.1, or 4.28.0 are affected when they rely on the impacted CRS rule families to inspect XML request bodies. The issue applies at paranoia levels PL1 through PL4.
What does an attacker need to do to evade detection?
An attacker can place a payload in an XML attribute value rather than element text. The affected rules inspect XML element text through XML:/* but do not inspect attribute values, allowing payloads such as XSS or SQL injection strings in attributes to bypass those rules.
Which rule coverage is affected and which is not?
Approximately 159 rules in the 921, 930, 931, 932, 933, 934, 941, 942, and 943 families are affected. The 944 Java rule family is not affected because it includes XML://@* to inspect XML attributes.
What is the available remediation?
Upgrade OWASP CRS to version 3.3.10, 4.25.1, or 4.28.0, which contain the fix for XML attribute inspection.