{"record":{"id":"24dae7a742f8ae8f","repo":"crowdsecurity/crowdsec","slug":"rule-expansion-produced-d-groups-exceeding-maxim","errorCode":null,"errorMessage":"rule expansion produced %d groups, exceeding maximum of %d","messagePattern":"rule expansion produced (.+?) groups, exceeding maximum of (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/appsec_rule/modsecurity.go","lineNumber":219,"sourceCode":"\treturn result, nil\n}\n\n// crossProduct computes the AND-combination of two DNFs.\n// [[A],[B]] × [[C],[D]] = [[A,C],[A,D],[B,C],[B,D]]\nfunc crossProduct(a, b [][]*CustomRule) ([][]*CustomRule, error) {\n\tresult := make([][]*CustomRule, 0, len(a)*len(b))\n\n\tfor _, groupA := range a {\n\t\tfor _, groupB := range b {\n\t\t\tcombined := make([]*CustomRule, 0, len(groupA)+len(groupB))\n\t\t\tcombined = append(combined, groupA...)\n\t\t\tcombined = append(combined, groupB...)\n\t\t\tresult = append(result, combined)\n\t\t}\n\t}\n\n\tif len(result) > maxDNFGroups {\n\t\treturn nil, fmt.Errorf(\"rule expansion produced %d groups, exceeding maximum of %d\", len(result), maxDNFGroups)\n\t}\n\n\treturn result, nil\n}\n\nfunc (m *ModsecurityRule) generateRuleID(rule *CustomRule, appsecRuleName string, position int) uint32 {\n\th := fnv.New32a()\n\th.Write([]byte(appsecRuleName))\n\th.Write([]byte(rule.Match.Type))\n\th.Write([]byte(rule.Match.Value))\n\th.Write([]byte(fmt.Sprintf(\"%d\", position)))\n\n\th.Write([]byte(fmt.Sprintf(\"rule:%d\", m.ruleIndex)))\n\n\tfor _, zone := range rule.Zones {\n\t\th.Write([]byte(zone))\n\t}\n","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/appsec_rule/modsecurity.go#L201-L237","documentation":"While converting a DNF (disjunctive normal form) expression tree into modsecurity rules, the cross product of AND-groups exceeded maxDNFGroups. This is a combinatorial-explosion guard: a rule with many nested and/or conditions expands to more groups than the engine allows.","triggerScenarios":"Thrown at pkg/appsec/appsec_rule/modsecurity.go:219 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Simplify the rule: reduce the number of OR branches inside AND groups, or split it into several smaller rules","Avoid deep and/or nesting — each OR multiplied inside an AND multiplies the group count"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}