The chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, 2026-03-02, at 20:30 CET (CEST during summer in the Northern Hemisphere). That's the 1st Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).

Archived previous meetings and their decision are here.

What happened in the meantime since the chat last month

Outside development

• FIXME

Inside development

Rules

• LTS release is coming by end of month

CRS Sandbox

• FIXME: Please fill in

Security

• FIXME: Please fill in

Plugins

• There is a proposal for a new plugin Create httpd fingerprinting detection plugin #4479

Documentation and Public Relations

• FIXME: Please fill in

Project Administration and Sponsor relationships

• No news here.

Tools

• FIXME: Please fill in

Testing incl. Seaweed and many future plans

• Nothing here.

Containers

• Versions updated with CRS 4.24.0 shipped.

Project discussions and decisions

• feat: update list of unix commands #4446 - discuss FPs increase
• Move Collabora Online rule exclusions to it's own plugin nextcloud-rule-exclusions-plugin#146 Should we split the Collabora Online rules into it's own plugin?
• False positive for rule 942200 by Googlebot after upgrading to v4.24.0 #4502
• Issue #4440 request for addition of a new anomaly score.

Rules development, key project numbers

PRs that have been merged since the last meeting

• refactor: add generated-from comment to 943110 rule #4505
• refactor: create 941190 .ra file #4499
• chore(deps): update owasp/modsecurity-crs:nginx docker digest to 231d4ba in tests/docker-compose.yml #4501
• chore(deps): update owasp/modsecurity-crs:apache docker digest to 781ee9e in tests/docker-compose.yml #4500
• feat: move 930110 to regex-assembly #4494
• refactor: create 921110 .ra file #4495
• refactor: create 921120 .ra file #4496
• refactor: create 921160 .ra file #4497
• chore(pre-commit): add regex format also #4503
• refactor: create 941320 .ra file #4491
• refactor: create 944300 .ra file #4490
• refactor: create 941330 .ra file #4492
• fix(942200): FP against comma and single quote in French addresses #4476
• refactor: create 934130 .ra file #4487
• fix: don't block json variable names called profile on libmodsecurity3/coraza #4477
• chore: post-release v4.25.0-dev #4485
• chore: release v4.24.0 #4482
• fix: test 999999 syntax #4483
• fix: add more exclusions for Google Funding Choices cookie #4484
• docs: recommend libmodsecurity3 minimum version 3.0.10 #4469
• docs: recommend mod_security2 minimum version 2.9.6 #4470
• feat: move 932190 to regex-assembly #4475
• fix(933100): reduce false positive on Extensible Metadata Platform and xsl-stylesheets #4445
• ci: update ftw release #4473
• chore: fix renovatebot config #4472
• refactor(951130): convert DB2 leakage rule to regex-assembly #4462
• refactor(951260): convert Sybase leakage rule to regex-assembly #4461
• refactor(951250): convert SQLite leakage rule to regex-assembly #4460
• refactor(951220): convert MSSQL leakage rule to regex-assembly #4459
• refactor(951180): convert Informix leakage rule to regex-assembly #4465

We merged 30 PRs since the last monthly project chat.

Open PRs

Open PRs marked DRAFT or work in progress or needs action

• refactor: create 941120 .ra file #4498
• refactor: create 943120 .ra file #4506
• feat: move 943100 to regex-assembly #4504
• refactor: create 930110 .ra file #4486
• feat: updated unix shell builtins #4271
• refactor: create 933140 and 933180 .ra files #4488
• refactor: create rule 931100 and 931110 .ra files #4489
• refactor: create 941170 .ra file #4493
• feat: added detection for quote evasion #3813
• fix(920540): allow rule exclusions for specific targets #4405
• feat: add rule 920442 on PL3 to detect more file extensions #4324
• docs: add prerequisites section for new contributors #4408
• feat: update list of unix commands #4446
• chore: improves quant output with run details #4318
• fix(921422): reduce false positive #4433
• fix(942390): move to regex-assembly #4011
• feat: add rule 920550 on PL2 to detect more file extensions #4323
• feat(900100): adding a new score - danger #4439
• feat: add 921500 - Nonstandard urlencode characters in path #4302
• feat(942500): stronger hardening to improve PL1 protection #4328
• fix(942360): update sqli payloads #4238
• fix(942360): avoid c-type comment evasion #4325
• fix(931130): Isolating 2-chars sequence with high risk of false positive on high entropy input #4304
• docs: comment on threshold should be more alarming #4330
• fix(security): resolve SQL injection protection bypass (942380 PL2) #3720

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp.org/slack/invite .

Everybody is welcome to join our community chat.