megachangelog
Security2026-09-01

WAF - Improved SQL Injection Detection for Complex Query Syntax

Cloudflare WAF now includes enhanced protection against SQL injection attempts that exploit complex query syntax, specifically covering WHERE comparisons combined with WITH clauses. This new detection rule blocks these attacks by default.

This release introduces a new threat detection to enhance protection against SQL injection (SQLi) attempts exploiting complex query syntax.

Key Findings

  • SQLi Protection: Improved coverage for SQL injection patterns involving WHERE comparisons combined with WITH clauses.
RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
Cloudflare Managed Ruleset...bcfa0966N/ASQLi - WHERE Comparison With WITH ClauseLogBlockThis is a new detection.
wafsecuritysql-injectionthreat-detection

Source: original entry ↗