Security2026-09-01
WAF - Improved SQL Injection Detection for Complex Query Syntax
Cloudflare WAF now includes enhanced protection against SQL injection attempts that exploit complex query syntax, specifically covering WHERE comparisons combined with WITH clauses. This new detection rule blocks these attacks by default.
This release introduces a new threat detection to enhance protection against SQL injection (SQLi) attempts exploiting complex query syntax.
Key Findings
- SQLi Protection: Improved coverage for SQL injection patterns involving WHERE comparisons combined with WITH clauses.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...bcfa0966 | N/A | SQLi - WHERE Comparison With WITH Clause | Log | Block | This is a new detection. |
wafsecuritysql-injectionthreat-detection
Source: original entry ↗