WAF Release - 2026-09-22
This release introduces new threat detections to enhance protection against Server-Side Request Forgery (SSRF) attempts using non-standard IP notations or jar loopback payloads, alongside new defenses against Server-Side Template Injection (SSTI) targeting Jinja environments.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | N/A | SSRF - Cloud,Link-Local non-standard IP notation | Log | Block | This is a new detection. | |
| Cloudflare Managed Ruleset | N/A | SSRF - Block jar HTTP loopback payload | Log | Block | This is a new detection. | |
| Cloudflare Managed Ruleset | N/A | SSRF - Local non-standard IP notation | Log | Block | This is a new detection. | |
| Cloudflare Managed Ruleset | N/A | SSTI - Jinja Dangerous Globals Chain | Log | Block | This is a new detection. |