crowdsec
v1.8.2Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
- Maintenance
- Active93 commits in 3 months · bus factor 2
- License
- MITPermissive · OSI-approved
- Security
- 5 advisories1 high, 3 medium, 1 low · Scorecard 7.4/10
- Supported versions
- No scheduleendoflife.date does not track this project
15.6k stars · 766 forks · 306 open issues · last release 19 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 5 most recent advisories published by the maintainers: 1 high, 3 medium, 1 low. Check the patched version against the one you run.
- lowGHSA-g9hc-g4w6-4mfxOct 27, 2026Hardcoded InsecureSkipVerify disables TLS certificate validation in notification-splunk plugin
- Affected
- <= 1.8.1
- mediumGHSA-g2x2-jgfg-pg7gAug 31, 2026HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length
- Affected
- >= 0, <= 1.7.8
- Patched in
- 1.8.0
- mediumGHSA-rh69-4vqj-9gj8Aug 31, 2026Unbounded request-body read in kubernetes-audit acquisition webhook (memory-exhaustion DoS)
- Affected
- <= 1.7.8
- Patched in
- 1.8.0
- highCVE-2026-44982May 27, 2026CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests
- Affected
- =>1.5.0, =<1.7.7
- Patched in
- 1.7.8
- mediumCVE-2026-44981May 27, 2026CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression
- Affected
- >= 1.7.0
- Patched in
- 1.7.8