AWS waf: SQL database managed rule group static version 2.5 release
Summary
Added changelog entry for SQL database managed rule group static version 2.5, updating SQLi_BODY and all SQLiExtendedPatterns rules to reduce false positives and improve detection.
Security assessment
Documents an update to AWS WAF managed SQL injection detection rules (SQLi_BODY, SQLiExtendedPatterns_*) improving detection accuracy; it is security-feature documentation rather than a fix for a specific disclosed vulnerability or incident.
Evidence
| Released static version 2.5 of this rule group. Updated the `SQLi_BODY` rule and all `SQLiExtendedPatterns` rules to reduce false positives and improve detection. | 2026-09-16
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-changelog.md b/waf/latest/developerguide/aws-managed-rule-groups-changelog.md index f76bd3768..1e22d4b1e 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-changelog.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-changelog.md @@ -22,0 +23,9 @@ Rule group and rules | Description | Date +[SQL database managed rule group](./aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-sql-db) This release updates the following rules: + + * `SQLi_BODY` + * `SQLiExtendedPatterns_QUERYARGUMENTS` + * `SQLiExtendedPatterns_BODY` + * `SQLiExtendedPatterns_HEADER` + * `SQLiExtendedPatterns_URIPATH` + +| Released static version 2.5 of this rule group. Updated the `SQLi_BODY` rule and all `SQLiExtendedPatterns` rules to reduce false positives and improve detection. | 2026-09-16