CrowdSec has released version 1.8.0 of its open-source security engine, introducing new bot detection capabilities for its web application firewall (WAF) component and addressing two denial-of-service (DoS) vulnerabilities in its log acquisition datasources. The update, which became available on August 31, also includes improvements for Kubernetes integration and performance enhancements.
The most significant new feature is the bot detection system integrated into the CrowdSec WAF. When enabled, this system presents incoming HTTP clients with a challenge and fingerprinting page before they can access the protected website. CrowdSec then evaluates the challenge response and compares the client's fingerprint against user-configured rules to determine if the client appears legitimate.
However, the bot detection mechanism has specific technical requirements that may prevent some legitimate users from accessing sites. The challenge requires SSE4.1 instruction set support and writable-executable memory, which could block older or hardened client systems. Additionally, users with disabled cookies will now receive an explicit error message. CrowdSec advises users to thoroughly test this feature with their specific audience before widespread deployment, as the challenge page is presented to all visitors, not just suspected bots.
The 1.8.0 release also patches two DoS vulnerabilities found in CrowdSec's log intake components. One vulnerability affected the HTTP acquisition datasource, which lacked a size limit for decompressed request bodies and implicitly trusted the `Content-Length` header provided by the sender. The second vulnerability was present in the Kubernetes audit webhook, where request bodies were read without bound. Both issues could have allowed an attacker to disrupt the CrowdSec instance itself by feeding it malformed or excessively large logs. Users who rely on HTTP or Kubernetes audit webhooks for log collection are strongly encouraged to update, regardless of their interest in the new bot detection features.
Beyond security fixes and bot detection, the update brings several other enhancements. A new dedicated Kubernetes datasource now allows CrowdSec to pull logs directly from the Kubernetes API server, streamlining the collection process for cluster operators. The expression language has been extended with new HTTP helpers, enabling parsers and scenarios to query external services during decision-making. Furthermore, performance improvements have been made to the decisions stream endpoint in the local API, which will particularly benefit environments running numerous remediation components against a single API.
While the bot detection feature is opt-in and remains disabled by default, the fixes for the two DoS vulnerabilities are applied automatically with the update. CrowdSec is available for free on GitHub.
