WAF Release - 2026-09-22

This release introduces new threat detections to enhance protection against Server-Side Request Forgery (SSRF) attempts using non-standard IP notations or jar loopback payloads, alongside new defenses against Server-Side Template Injection (SSTI) targeting Jinja environments.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · ca05d6c847834f75a317c33b5f21b651 · N/A · SSRF - Cloud,Link-Local non-standard IP notation · Log · Block · This is a new detection.

Cloudflare Managed Ruleset · 40b93de7a8f848709c4ec3e60f0313d6 · N/A · SSRF - Block jar HTTP loopback payload · Log · Block · This is a new detection.

Cloudflare Managed Ruleset · 48dfa3e5bef84063914edfe175cd912a · N/A · SSRF - Local non-standard IP notation · Log · Block · This is a new detection.

Cloudflare Managed Ruleset · cd1de1fd21c443508f9073f2a1ba83f6 · N/A · SSTI - Jinja Dangerous Globals Chain · Log · Block · This is a new detection.