[tom_usher]

Seems to be a change in Cloudflare's managed WAF ruleset - any site using that will have URLs containing 'camel' blocked due to the 'Apache Camel - Remote Code Execution - CVE:CVE-2025-29891' (a9ec9cf625ff42769298671d1bbcd247) rule.

That rule can be overridden if you're having this issue on your own site.

[internetter]

> any site using that will have URLs containing 'camel' blocked

What engineer at cloudflare thought this was a good resolution?

[Raed667]

I doubt the system is that simple. No one wrote a rule saying `if url.contains("camel") then block()` it's probably an unintended side-effect

[cbovis]

Confirmed here: https://www.cloudflarestatus.com/incidents/gshczn1wxh74

[oncallthrow]

WAFs are so shit

[ronsor]

WAFs are literally "a pile of regexes can secure my insecure software"

[UltraSane]

But are they less shit than the shitty software they filter traffic for?