Proposed changes

Hello,

We have a concrete CVE example exploiting this via a PHP injection in an HTTP header: CVE-2026-1540

According to @fzipi ’s analysis available here: #4326 (comment) , the performance impact is minimal.

This adjustment has been implemented in our WAF for years, with no false positives observed over that period. We therefore consider it fully suitable for PL1.

What do you think?

PR Checklist

• I have read the CONTRIBUTING doc
• I have added positive tests proving my fix/feature works as intended.
• I have added negative tests that prove my fix/feature considers common cases that might end in false positives
• In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
• My test use the comment field to write the expected behavior
• I have added documentation for the rule or change (when appropriate)

Further comments

For the reviewer

• Positive and negative tests were added
• Tests cover the intended fix/feature properly
• No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
• In case a regular expression was changed, there is no ReDOS
• Documentation is clear for the rule/change