WAF - WAF Release - 2026-09-22

This release introduces new threat detections to enhance protection against Server-Side Request Forgery (SSRF) attempts using non-standard IP notations or jar loopback payloads, alongside new defenses against Server-Side Template Injection (SSTI) targeting Jinja environments.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	...5f21b651	N/A	SSRF - Cloud,Link-Local non-standard IP notation	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	...0f0313d6	N/A	SSRF - Block jar HTTP loopback payload	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	...75cd912a	N/A	SSRF - Local non-standard IP notation	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	...a1ba83f6	N/A	SSTI - Jinja Dangerous Globals Chain	Log	Block	This is a new detection.