bunkerweb

Documentation : https://docs.bunkerweb.io/1.6.18~rc3/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.18-rc3 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.18-rc3
• BunkerWeb : bunkerity/bunkerweb:1.6.18-rc3 or ghcr.io/bunkerity/bunkerweb:1.6.18-rc3
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.18-rc3 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.18-rc3
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.18-rc3 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.18-rc3
• UI : bunkerity/bunkerweb-ui:1.6.18-rc3 or ghcr.io/bunkerity/bunkerweb-ui:1.6.18-rc3
• API : bunkerity/bunkerweb-api:1.6.18-rc3 or ghcr.io/bunkerity/bunkerweb-api:1.6.18-rc3

GitLab mirror : registry.gitlab.com/bunkerity/bunkerweb/:1.6.18-rc3 (same digests)

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.18~rc3&filter=all&dist=

Changelog :

• [BUGFIX] crowdsec: CROWDSEC_METADATA_CACHE_SIZE now defaults to 24m, so report metadata for the whole Community Blocklist fits in stream mode. (Refs #4135)
• [SECURITY] api: when API_LISTEN_HTTPS=yes, the scheduler, UI, API service and bwcli check that an instance presents the generated API certificate (SHA-256 pin) instead of trusting any. A mismatch is logged and the call still falls back to HTTP.
• [SECURITY] ui: failed logins (password, TOTP or recovery code) are counted per client IP and per username in the database, and five in 15 minutes lock that IP or username for 15 minutes (LOGIN_THROTTLE, LOGIN_MAX_ATTEMPTS, LOGIN_WINDOW_MINUTES, LOGIN_LOCKOUT_MINUTES).
• [SECURITY] core: an IPv6 address is now one ban whatever its spelling (expanded, upper case or IPv4-mapped), in every ban, unban and lookup path.
• [SECURITY] core: an IPv4-mapped IPv6 client (::ffff:a.b.c.d) now matches the IPv4 rules of IP lists, trusted proxies, bans and rate limits.
• [SECURITY] core: an invalid or zone-id entry in an IP list is now skipped instead of disabling the whole list.
• [SECURITY] docker: update the Alpine libexpat package to 2.10.0-r0 in the BunkerWeb and all-in-one images, fixing CVE-2026-117610, CVE-2026-118370 and two lower-severity libexpat CVEs.
• [FEATURE] core: plugins can run code at the TLS ClientHello of every service through the new ssl_client_hello phase (PLUGINS_ORDER_SSL_CLIENT_HELLO).
• [FEATURE] core: utils.add_ban accepts opts.if_absent for insert-only bans that never replace an existing ban, locally or in Redis.
• [FEATURE] bunkernet: BUNKERNET_FILTER_HEADERS (no, per service) limits a report to the User-Agent, Accept, Accept-Encoding, Accept-Language, Content-Type and Content-Length request headers and blanks the values matched in request headers and cookies, also for reports queued before the upgrade. By default a report carries every request header, as before; the plugin documentation lists what each value sends.
• [FEATURE] core: a service can be named by an IPv4 or an IPv6 address (SERVER_NAME=2001:db8::1, bare, lowercase, compressed). NGINX also matches the bracketed Host form, and a name written another way logs a warning with its canonical spelling. (#4120)
• [BUGFIX] backup: MySQL 8+ clients, including on Fedora, can now back up and restore MySQL and MariaDB databases without the RELOAD privilege.
• [BUGFIX] bwcli: use the Linux package's Python interpreter, fixing startup crashes on RHEL 9.
• [BUGFIX] core: stream services no longer abort NGINX init when an HTTP-only plugin (PRO included) is installed, a regression in 1.6.17.
• [BUGFIX] core: local ban writes and unbans are now serialized per IP, and a writer that cannot take the lock fails with ban lock unavailable.
• [BUGFIX] installer: on Debian and Ubuntu, the installer warns that the distribution PostgreSQL client cannot back up a newer server and shows the PGDG commands to install a matching one.
• [BUGFIX] ui: report and ban dates carry their UTC offset, so the browser no longer shifts them by the viewer's time zone. (Fixes #4118)
• [BUGFIX] redis: Redis Cluster commands now follow ASK and MOVED redirections during slot migrations.
• [BUGFIX] reversescan: scanning an IPv6 client now works, and a port that could not be tried is no longer cached as closed.
• [BUGFIX] settings: URL settings (*_URLS, Cap.js, auth request sign-in) accept bracketed IPv6 hosts such as http://[2001:db8::1]:8080/.
• [BUGFIX] settings: IP list settings accept expanded and IPv4-mapped IPv6 addresses and refuse zone identifiers (fe80::1%eth0).
• [BUGFIX] core: the reverse DNS name of an IPv6 address with an embedded IPv4 part is now valid and no longer corrupts the next lookups.
• [BUGFIX] core, api, ui: IPv6 values of API_LISTEN_IP, API_LISTEN_ADDR and UI_LISTEN_ADDR now produce valid listeners.
• [BUGFIX] logging: a bracketed IPv6 syslog address such as udp://[2001:db8::1]:514 is now used instead of being ignored.
• [BUGFIX] ui: the setup wizard proposes the IPv6 address of the Host header as the server name when opened through an IPv6 address (it was truncated), and the services page handles a service name with a colon.
• [BUGFIX] redis: IPv6 Redis, Sentinel and Cluster hosts, bare or bracketed, now work in the core, sessions, jobs and the API rate limiter.
• [BUGFIX] redis: Redis Cluster now handles IPv6 nodes in slot discovery and in ASK and MOVED redirections.
• [BUGFIX] autoconf: Kubernetes pods with an IPv6 address now get a valid instance DNS name.
• [BUGFIX] core: an IPv6-only stack now starts, as the startup config keeps USE_IPV6, API_LISTEN_IP and DNS_RESOLVERS.
• [BUGFIX] api: updating an instance with PATCH /instances/{hostname} now returns the instance instead of an error.
• [BUGFIX] reversescan: once a decision is made, the remaining port scans are cancelled instead of left running until they time out.
• [BUGFIX] customcert: a rejected certificate no longer removes the one being served.
• [BUGFIX] blacklist, greylist, whitelist: removing a feed URL now also removes its cached rows, which could bring the old entries back.
• [BUGFIX] jobs: a renewed API certificate is now written to the local cache too, not only to the database.
• [BUGFIX] backup, bunkernet, db: a failed database dump, report cache write or job history cleanup now fails the job instead of counting as a success, and a negative DATABASE_MAX_JOBS_RUNS is refused instead of deleting the whole history.
• [BUGFIX] core: the internal API answers 400 instead of an error when a ban request body is not a JSON object.
• [BUGFIX] core: in multisite mode, utils.has_not_variable (used by external plugins) now compares each service with the value asked for.
• [BUGFIX] metrics: the requests query refuses a negative or fractional page start, an invalid page length and an unknown sort direction.
• [BUGFIX] bunkernet: the OS version id and codename are now read from /etc/os-release, and the README lists the instance details sent with each request.
• [BUGFIX] crowdsec: a path below a CROWDSEC_EXCLUDE_LOCATION location is now excluded too, not only the exact location.
• [BUGFIX] crowdsec: a captcha asked by AppSec alone can now be solved instead of being shown again.
• [BUGFIX] crowdsec: a CrowdSec decision on an IPv6 address written with an IPv4 tail is no longer applied to that IPv4 address.
• [BUGFIX] ui: the "More than 30 days" filter of the bans page now counts the permanent bans it shows.
• [BUGFIX] ui: sorting bans by time left now follows their remaining time, with permanent bans last.
• [BUGFIX] redis: with Redis Cluster, a ban held only in Redis stays enforced while a slot is resharded instead of failing open on TRYAGAIN, and other multi-key calls retry briefly.
• [BUGFIX] letsencrypt: the stale account recovery also recognizes the standard accountDoesNotExist rejection, so it works with any RFC 8555 certificate authority, not only Let's Encrypt.
• [BUGFIX] cors: with a regex CORS_ALLOW_ORIGIN, no longer send Access-Control-Allow-Origin for an origin the pattern does not match (it was echoed on served responses when CORS_DENY_REQUEST=no).
• [BUGFIX] ui: a refused two-factor enrolment code or password now shows the same secret and QR code again, so the code you already scanned can be retried instead of ending in "The totp token is invalid."
• [BUGFIX] modsecurity: a service named by an IP address no longer scores CRS rule 920350 for requests whose Host is one of its own addresses; any other numeric Host is still scored.