WAF - WAF Release - 2026-09-22

This release introduces new threat detections to enhance protection against Server-Side Request Forgery (SSRF) attempts using non-standard IP notations or jar loopback payloads, alongside new defenses against Server-Side Template Injection (SSTI) targeting Jinja environments. Ruleset Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset …5f21b651 N/A SSRF - Cloud,Link-Local non-standard IP notation Log Block This is a new detection. Cloudflare Managed Ruleset …0f0313d6 N/A SSRF - Block jar HTTP loopback payload Log Block This is a new detection.