OWASP Core Rule Set has many versions the latest is version 4.0 (release candidate), but I cannot find any indication about compatibility among various modsecurity releases.

Could these be used with any modsecurity version, or is there some specific version requirement?

1 Answer 1


OWASP CRS Team continuously develop Core-Rule-Set.

The current stable release is 3.3, the latest version from this branch is 3.3.4. The version 4.0 is not released yet, and it's under development.

The other release what still maintained is 3.2, there is the 3.2.3.

It's important that you must use the master branches, but the best would be that you use the released packages from here.

Both stable versions above need a particular version of ModSecurity. The Apache's mod_security2 module needs at least 2.9.6, and the libmodsecurity3 needs 3.0.8.

The reason is that the CRS versions contains a specific variable in set 922XXX: the MULTIPART_PART_HEADERS.

You can use these rule sets with older ModSecurity versions, but then you have to remove the REQUEST-922-MULTIPART-ATTACK.conf file.

If you use a supported Debian or Ubuntu system, then you can try this repository. This contains the latest versions of CRS, mod_security2 and libmodsecurity3.

  • remaining with with libapache2-mod-security2 2.9.3 that is latest official package of debian distro, what would be the best approach? make sense to use latest core rule set removing REQUEST-922-MULTIPART-ATTACK.conf?
    – AndreaF
    Apr 13, 2023 at 10:27
  • 1
    Yes. But as I suggested, there is a 3rd party Debian repository, which contains the newest libapache2-mod-security package. Note: I'm the maintainer of that repo, and I'm also the maintainer of packages for Debian.
    – airween
    Apr 13, 2023 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .