All pull requests

Pull requests

• fix: seclang scanner mis-parsing escaped quotes right after a macro

  3.xparser
  #3641·fzipi opened Sep 21, 2026Collaborator·

  ·
  14

• Create fopen_modsec

  #3640·AntonDemushkin opened Sep 21, 2026·

  ·
  6

• fix: rules-loading memory leaks on SecDefaultAction error paths and repeated msg/severity/logdata

  #3638·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Fix memory leak when SecGeoLookupDb loads a database more than once

  #3637·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Do not keep the @validateSchema parser errors in the operator

  #3636·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Fix memory leak in setvar when the current value is not numeric

  #3635·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Fix memory leak of the macro expanded regex in @rx and @rxGlobal

  #3634·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Fix leak of the ARGS XML parser context on malformed documents

  #3633·tomsommer opened Sep 19, 2026Contributor·

  ·
  2

• Fix fd and temporary file leak on truncated multipart payloads

  #3632·tomsommer opened Sep 19, 2026Contributor·

  ·
  6

• fix(iis): strip IPv6 zone/scope id from client IP string

  2.xPlatform - IIS
  #3631·A13501350 opened Sep 17, 2026·

  ·
  3

• v2: Return HTTP 400 for JSON completion errors without relaxing rejection

  2.x
  #3629·vortexopenclaw opened Sep 17, 2026·

  ·
  5

• CPTAddElement memory leak fix

  3.x
  #3628·chenuduss opened Sep 16, 2026Contributor·

  ·
  16

• fix: allow SecRuleScript without actions and stop parser state bleed into next rule

  3.x
  #3627·fzipi with CopilotAI opened Sep 14, 2026·

  ·
  1

  13

  

• add return value to acmp_build_binary_tree and check it result

  3.x
  #3626·chenuduss opened Sep 14, 2026Contributor·

  ·
  32

• IIS: fix ReadFileChunk latent overflow (allocate m_dwPageSize, not 1)

  2.xPlatform - IIS
  #3624·A13501350 opened Aug 27, 2026·

  ·
  4

• IIS: fix dead Host header fallback (r->hostname == NULL can never be true)

  2.xPlatform - IIS
  #3622·A13501350 opened Aug 27, 2026·

  ·
  2

• IIS: fix Content-Length formatting (correct printf specifier + full buffer size)

  2.xPlatform - IIS
  #3620·A13501350 opened Aug 27, 2026·

  ·
  6

• iis: drop chunked Transfer-Encoding when Content-Length is set

  2.xPlatform - IIS
  #3618·A13501350 opened Aug 22, 2026·

  ·
  2

• iis: fail closed (HTTP 500) on ModSecurity config load failure

  2.xPlatform - IIS
  #3617·A13501350 opened Aug 22, 2026·

  ·
  2

• Fix case-insensitive request header target exclusions

  3.x
  #3616·TejasButani001 opened Aug 18, 2026·

  ·
  8

• Perf/rule remove lookup

  3.x
  #3615·ziebarthw opened Aug 17, 2026·

  ·
  6

• fix: record real response status for IIS audit log F part

  2.xPlatform - IIS
  #3613·A13501350 opened Aug 14, 2026·

  ·
  12

• ci: statically link MinGW runtime into x86 fuzzy.dll and add 32-bit pool test

  2.xwindows
  #3611·A13501350 opened Aug 13, 2026·

  ·
  2

• test/fuzzer: fix AFL harness input handling and restore it to a compiling state

  3.x
  #3607·shotintoeternity opened Aug 1, 2026·

  ·
  6

• Allow connectors to avoid unused intervention log payload overhead

  3.x
  #3606·upgle opened Aug 1, 2026·

  ·
  2