This is Part 2 of the CRS 3.3 → 4.25 LTS migration series. Part 1 provided an overview of the migration. This post covers the crs-setup.conf changes — the most immediately breaking part of the upgrade for most operators. If you take one thing from this post: do not reuse your CRS 3 crs-setup.conf with CRS 4 without reviewing every variable in it. Some variables were renamed, some were removed, and several new ones are required for features that did not exist in CRS 3.

The release of CRS v4.25.0 LTS marks the moment the CRS 4 generation has its long-term support anchor. If you have been running CRS 3.3.x — waiting for stability before committing to an upgrade — that moment is now. This is the first post in a series walking through everything you need to know to migrate from CRS 3.3.9 (the last CRS 3 LTS release) to CRS 4.25.0 LTS. The series is not a quick upgrade guide. It is a deliberate, post-by-post treatment of each dimension of the migration so that you can plan and execute without surprises.

## Impact A bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php ...

What's Changed ⭐ Important changes feat(920640): add rule to enforce content-type if there is body by @fzipi in #4406 🆕 New features and detections 🎉 feat(lfi): Add detection for Vite.js pat...

Contribute to netnea/netnea-crs-upgrading-plugin development by creating an account on GitHub.

What's Changed 🆕 New features and detections 🎉 feat: update restricted file extensions by @EsadCetiner in #4287 feat(930120): adding conf file for PrestaShop 1.6 / 1.7 / 8+ & Magento 2 by ...