# CrowdSec v1.8.0

- Product: CrowdSec (https://whatsnew.fyi/product/crowdsec)
- Vendor: CrowdSec
- Date: 2026-08-31
- Version: v1.8.0
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.8.0
- Labels: Platforms: Windows, Linux

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Bot detection feature for CrowdSec WAF that serves clients a challenge and fingerprinting page to evaluate legitimacy
- **added** — Dedicated Kubernetes datasource that fetches logs directly from the k8s apiserver
- **added** — HTTP helpers for the expression language to query external services from parsers and scenarios
- **changed** — Performance improvements on the decisions stream endpoint in LAPI
- **changed** — Challenge detection to identify if cookies are disabled and display an explicit error message
- **changed** — Database composite index for decision dedup
- **changed** — Proof-of-work solving optimization and increased difficulty
- **changed** — WAF challenge threshold support
- **changed** — cscli console status revamped to be all-in-one
- **changed** — WAF auth timeout to LAPI can now be configured
- **changed** — RejectSubmission now generates an alert
- **security** — Fixed denial of service vulnerability in HTTP acquisition datasource from decompressed body cap and Content-Length trust
- **security** — Fixed denial of service vulnerability from unbounded request-body read in kubernetes-audit acquisition webhook
- **fixed** — Leakybuckets alerts now own their strings
- **fixed** — Alerts create metas only if alert was not discarded
- **fixed** — Kubernetes-audit added support for max body size
- **fixed** — Usage metrics set a maximum payload size
- **fixed** — LAPI uses decision id as cursor for delta pull
- **fixed** — HTTP acquisition set default max body size and enforce it for compressed streams
- **fixed** — Acquisition transformation being ignored

##### Bot detection with CrowdSec WAF

This release brings a major change to the CrowdSec WAF: a bot detection feature.

If enabled, clients will be served a challenge + fingerprinting page before accessing the website.
CrowdSec will evaluate the challenge and check the fingerprint against pre-configured rules to decide whether the client looks legitimate or not.

You can find more information about this new feature in [the documentation](https://docs.crowdsec.net/docs/next/appsec/bot_detection/intro).

Other notable changes include:
 - A dedicated kubernetes datasource: crowdsec will fetch logs directly from the k8s apiserver
 - New HTTP helpers for the expression language, to query external services from parsers and scenarios
 - Performance improvements on the decisions stream endpoint in LAPI

##### Security Notice

This release fixes 2 denial of service vulnerabilities in the HTTP and k8s-audit datasources:
 - HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length: [GHSA-g2x2-jgfg-pg7g](https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-g2x2-jgfg-pg7g)
 - Unbounded request-body read in kubernetes-audit acquisition webhook: [GHSA-rh69-4vqj-9gj8](https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rh69-4vqj-9gj8)

##### New Features

* k8s log acquisition datasource (#4221) @sabban
* Waf challenge mode (#4268) @blotus

##### Improvements

* challenge: detect if cookies are disabled and display an explicit error message (#4628) @blotus
* db: add composite index for decision dedup (#4619) @blotus
* Improve pow solving : optimize & increase difficulty (#4617) @buixor
* Bot detection unify scores (#4608) @buixor
* Dedup code reject submission alert generation (#4606) @buixor
* make `RejectSubmission` generate an alert (#4602) @buixor
* waf challenge: add threshold support (#4593) @blotus
* revamp 'cscli console status' to be all-in-one (#4592) @buixor
* [bot-detection] Fix leak of background pre-warmer goroutine (#4589) @buixor
* waf: allow to configure auth timeout to LAPI (#4585) @blotus
* Add cs_machines_heartbeat_seconds metric (#4569) @kushiemoon-dev
* Cscli hub list improvements (#4567) @buixor
* expr: add HTTP helpers (#4533) @blotus

##### Bug Fixes

* leakybuckets: make alerts own their strings (#4643) @blotus
* alerts: create metas only if alert was not discarded (#4633) @blotus 
* k8s-audit: add support for max body size (#4630) @blotus
* Usage metrics: set a maximum payload size (#4629) @blotus
* lapi: use decision id as cursor for delta pull (#4620) @blotus
* acquis(http): Set default max body size and enforce it as well for compressed streams (#4616) @blotus
* acquisition: fix transformation being ignored (#4609) @blotus
* fpscanner: add missing fields (#4604) @blotus
* docs: fix broken Vagrant include link in test README (#4594) @latent-9
* challenge: require SSE4.1 + WX memory (#4590) @blotus
* WAF: supress erroneous warnings/errors when loading config / no rule has matched (#4587) @blotus
* Bot Detection: keep the original URL in the generated alert (#4586) @buixor
* fix(docker): allow spaces in ENROLL_INSTANCE_NAME (#4582) @sahilnyk
* apiclient: return nil response if we couldnt connect to LAPI (#4573) @blotus
* cscli lapi register: no error if the credentials file does not exist (#4570) @lopster568
* fix(docker): avoid panic on colliding nested crowdsec labels (#4555) @arpitjain099
* fix(syslog): don't close the shared acquisition output channel (#4553) @alxrxs
* waf: track id/name pairs for all subrules (#4505) @blotus
* apiserver: prevent from fetching JWT token from query string (#4554) @blotus
* fix(leakybucket): emit overflow before pouring the next event (#4547) @blotus
* loki: prevent duplicate log ingestion and improve timestamp handling (#4498) @Anulo2
* db: use proper mutex when checking if flush can happen (#4528) @blotus
* db: do not flush alerts with active decisions (#4527)

_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0]_