Comment by tom_usher
3 days ago
Seems to be a change in Cloudflare's managed WAF ruleset - any site using that will have URLs containing 'camel' blocked due to the 'Apache Camel - Remote Code Execution - CVE:CVE-2025-29891' (a9ec9cf625ff42769298671d1bbcd247) rule.
That rule can be overridden if you're having this issue on your own site.
> any site using that will have URLs containing 'camel' blocked
What engineer at cloudflare thought this was a good resolution?
I doubt the system is that simple. No one wrote a rule saying `if url.contains("camel") then block()` it's probably an unintended side-effect
If this is a bet, I'll happily take the other side and give you 4:1 on it.
1 reply →
Akamai has been doing precisely that for years & years...
2 replies →
Judging by previous outages it was probably a poorly tested overcomplicated regex which matched to much.
[dead]
Confirmed here: https://www.cloudflarestatus.com/incidents/gshczn1wxh74
WAFs are so shit
WAFs are literally "a pile of regexes can secure my insecure software"
To be fair to WAFs, most are more than just a pile of regexes. Things like detecting bot traffic - be it spammers or AI scrapers - are valuable (ESPECIALLY the AI scraper detection, because unlike search engines these things have zero context recognition or respect for robots.txt and will just happily go on and ingest very heavy endpoints), and the large CDN/WAF providers can do it even better because they can spot shit like automated port scanners, Metasploit or similar skiddie tooling across all the services that use them.
Honestly what I'd _love_ to see is AWS, GCE, Azure, Fastly, Cloudflare and Akamai band together and share information about such bad actors, compile evidence lists and file abuse reports against their ISP - or in case the ISP is a "bulletproof hoster" or certain enemy states, initiate enforcement actors like governments to get these bad ISPs disconnected from the Internet.
3 replies →
They do mitigate known vulnerabilities.
2 replies →
But are they less shit than the shitty software they filter traffic for?