Cloudflare 2026-yil 25-oktabrda o'zining Web Application Firewall (WAF) tizimi uchun shoshilinch yangilanishni e'lon qildi. Ushbu yangilanish Brotli zaifligi sifatida kuzatiladigan CVE-2026-111497 uchun ikkita aniqlash qoidasini joriy etadi.
Ushbu qoidalar Brotli tanasi kodlashini e'lon qilgan so'rovlar va Next.js tasvirni optimallashtirish nuqtasiga kiradigan trafikni maxsus nishonga oladi. Standart sozlamalarda ikkala qoida ham Log rejimida yoqilgan bo'lib, bu mos keladigan so'rovlarni avtomatik ravishda bloklamasdan ko'rinishni ta'minlaydi.
Yangi aniqlash qoidalari Cloudflare Managed Ruleset'ga qo'shildi. Biroq, mos kelish shartlari qonuniy trafikni ham o'z ichiga oladi, shuning uchun mos kelish potentsial ekspluatatsiya urinishini tasdiqlamaydi. Cloudflare mijozlarga bloklashni yoqishdan oldin har qanday mos kelishlarni baholashni tavsiya qiladi.
Birinchi qoida, …ca706f3c suffiksi bilan aniqlanadi, Content-Encoding: br sarlavhasini o'z ichiga olgan kiruvchi so'rovlarni aniqlaydi. Ushbu sarlavha so'rov tanasi Brotli kodlashidan foydalanayotganini bildiradi, ya'ni siqilgan so'rov tanalarini yuboradigan qonuniy mijozlar ushbu aniqlashni ishga tushirishi mumkin.
Cloudflare ushbu shartni Accept-Encoding: br sarlavhasini o'z ichiga olgan so'rovlardan ajratadi, bu qoida mos kelmaydi. Ushbu yangilanish Cloudflare'ning Brotli uchun javob siqish sozlamalarini ham o'zgartirmaydi, so'rov tanasi aniqlashini javob siqishdan alohida saqlaydi.
Ikkinchi qoida, …402fe5bb suffiksi bilan aniqlanadi, Next.js tasvirni optimallashtirish uchun ishlatiladigan /_next/image nuqtasiga so'rovlarni moslashtiradi.
Ushbu qoida faqat zararli trafikni nishonga olish o'rniga qonuniy tasvirni optimallashtirish so'rovlarini ham qamrab oladi. Ushbu qoidaning amalini Block ga o'zgartirish optimallashtirilgan tasvirlarning yuklanmasligiga va ilovalarda tasvir yetkazib berishning buzilishiga olib kelishi mumkin.
Qoidalar to'plamining standart sozlamalari ostida ikkala aniqlash qoidasi mos keladigan so'rovlarni bloklamasdan ularni jurnalga yozadi. Mijozlar ushbu mos kelishlarni o'z tahlillarida ko'rib chiqishlari va operatsion ta'sirini baholagandan so'ng har qanday qoidani trafikni bloklash uchun sozlashlari mumkin. Shuning uchun jurnalga yozish belgilangan shartlarga mos keladigan so'rovlarni bloklash o'rniga ko'rinishni ta'minlaydi.
E'lon qilingan yangilanishda qaysi dasturiy ta'minot versiyalari ta'sirlanganligi, zaiflik jiddiyligi balli, ekspluatatsiya uchun shartlar yoki faol ekspluatatsiya dalillari ko'rsatilmagan.
Bundan tashqari, u hech qanday potentsial ekspluatatsiya yuklamalarini tasvirlamaydi. Shunday qilib, yangi qoidalar mos keladigan har bir so'rov zaiflikni nishonga olayotganini isbotlash sifatida talqin qilinmasligi kerak.
Cloudflare mavjud qoidalar to'plami darajasidagi amal bekor qilishlari darhol bloklashni joriy etishi mumkinligi haqida ogohlantirdi. Agar yangi qoidalar uchun bekor qilish Block ga o'rnatilgan bo'lsa, mos keladigan so'rovlar standart Log amalidan qat'i nazar, joylashtirishdan so'ng darhol bloklanishi mumkin. Bu holat noto'g'ri ijobiy natijalarga olib kelishi va qonuniy trafikni buzishi mumkin.
Administratorlar joylashtirishdan oldin bekor qilishlarni diqqat bilan ko'rib chiqishlari kerak. Ehtiyotkorroq joriy etish uchun Cloudflare qoida darajasidagi Log bekor qilishlarini joriy etish va Block ga o'tishdan oldin mos keladigan so'rovlarni tekshirishni tavsiya qiladi. Ushbu baholash Brotli so'rov tanalarini qabul qiladigan yoki Next.js optimallashtirish orqali tasvirlarni taqdim etadigan ilovalar uchun ayniqsa muhimdir.
Cloudflare announced an emergency release of its Web Application Firewall (WAF)on October 25, 2026. This update introduces two detection rules for the Brotli vulnerability tracked asCVE-2026-111497.
These rules specifically target requests that declare Brotli body encoding and traffic accessing the Next.js image optimization endpoint. By default, both rules are enabled in Log mode, which allows for visibility without automatically blocking any matching requests.
The new detection rules have been added to the Cloudflare Managed Ruleset. However, the matching conditions include legitimate traffic, so a match does not confirm a potential exploitation attempt. Cloudflare advises customers to evaluate any matches before enabling blocking.
The first rule, identified by the suffix …ca706f3c, detects incoming requests containing the header Content-Encoding: br. This header indicates that the request body is using Brotli encoding, which means that legitimate clients submitting compressed request bodies may trigger this detection.
Cloudflare distinguishes this condition from requests that include the header Accept-Encoding: br, which the rule does not match. This update also does not change Cloudflare’s response-compression settings for Brotli, keeping request-body detection separate from response compression.
The second rule, identified by the suffix …402fe5bb, matches requests to the /_next/image endpoint used for Next.js image optimization.
This rule encompasses legitimate image optimization requests rather thantargeting solely malicious traffic. Changing this rule’s action to Block may cause optimized images to fail to load and disrupt the delivery of images in applications.
Under the default settings of the ruleset, both detection rules log matching requests without blocking them. Customers can review these matches in their analytics and configure either rule to block traffic after assessing its operational impact. Therefore, logging provides visibility rather than blocking requests that match the specified conditions.
The release announcement does not specify which software versions are affected, a vulnerability severity score, prerequisites for exploitation, or evidence of active exploitation.
Furthermore, it does not describe any potential exploit payloads. As such, the new rules should not be interpreted as proof that every matching request is targeting the vulnerability.
Cloudflare has cautioned thatexisting ruleset-level action overrides could impose immediate blocking. If an override is set to Block for the new rules, matching requests may be blocked immediately upon deployment, regardless of the default Log action. This situation could lead to false positives and disrupt legitimate traffic.
Administrators should carefully review overrides before deployment. For a more cautious rollout, Cloudflare recommends implementing rule-specific Log overrides and examining matching requests before switching to Block. This evaluation is particularly essential for applications that accept Brotli request bodies or serve images through Next.js optimization.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.