Collaborative behaviour-based IPS
Security engine that parses logs to detect aggressive behaviour, blocks it with remediation components and shares signals in a community blocklist.
CrowdSec reads logs from web servers, SSH and many other services, applies scenarios that describe malicious behaviour (brute force, scans, crawling) and makes decisions such as banning an IP. Separate remediation components (bouncers) enforce decisions in firewalls, web servers and CDNs.
Instances can share signals with the CrowdSec network and receive a community blocklist in return. It also includes an application security component (WAF) for HTTP traffic.
MIT · MIT License · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: MIT.
4 published advisories for CrowdSec in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.
GHSA-rh69-4vqj-9gj8medium2026-08-31
Unbounded request-body read in kubernetes-audit acquisition webhook (memory-exhaustion DoS)
GHSA-g2x2-jgfg-pg7gmedium2026-08-31
HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length
GHSA-rw47-hm26-6wr7CVE-2026-44982high2026-05-27
CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests
GHSA-273h-gvwr-c3qjCVE-2026-44981medium2026-05-27
CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Nginx-based web application firewall
WAF and hardened reverse proxy based on Nginx, with ModSecurity and the OWASP CRS, bot protection and a web UI, for Docker, Kubernetes or Linux.
Web application firewall engine
Cross-platform WAF engine (libmodsecurity) for Apache, Nginx and IIS, typically used with the OWASP Core Rule Set. Now an OWASP project.
ModSecurity-compatible WAF library in Go
OWASP WAF library written in Go, compatible with ModSecurity SecLang rules and the OWASP Core Rule Set, embeddable in Go apps and proxies.
Network protocol analyser
The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.
Network security monitoring and traffic analysis framework
Network analysis framework, formerly Bro, that turns traffic into rich, structured logs of connections and protocols, with its own scripting language.
Network IDS, IPS and security monitoring engine
High-performance network threat detection engine from the OISF: signature-based IDS/IPS, protocol logging and file extraction in one multi-threaded engine.
