crowdsecurity/crowdsec · error

rule expansion produced %d groups, exceeding maximum of %d

Error message

rule expansion produced %d groups, exceeding maximum of %d

What it means

While converting a DNF (disjunctive normal form) expression tree into modsecurity rules, the cross product of AND-groups exceeded maxDNFGroups. This is a combinatorial-explosion guard: a rule with many nested and/or conditions expands to more groups than the engine allows.

Source

Thrown at pkg/appsec/appsec_rule/modsecurity.go:219

	return result, nil
}

// crossProduct computes the AND-combination of two DNFs.
// [[A],[B]] × [[C],[D]] = [[A,C],[A,D],[B,C],[B,D]]
func crossProduct(a, b [][]*CustomRule) ([][]*CustomRule, error) {
	result := make([][]*CustomRule, 0, len(a)*len(b))

	for _, groupA := range a {
		for _, groupB := range b {
			combined := make([]*CustomRule, 0, len(groupA)+len(groupB))
			combined = append(combined, groupA...)
			combined = append(combined, groupB...)
			result = append(result, combined)
		}
	}

	if len(result) > maxDNFGroups {
		return nil, fmt.Errorf("rule expansion produced %d groups, exceeding maximum of %d", len(result), maxDNFGroups)
	}

	return result, nil
}

func (m *ModsecurityRule) generateRuleID(rule *CustomRule, appsecRuleName string, position int) uint32 {
	h := fnv.New32a()
	h.Write([]byte(appsecRuleName))
	h.Write([]byte(rule.Match.Type))
	h.Write([]byte(rule.Match.Value))
	h.Write([]byte(fmt.Sprintf("%d", position)))

	h.Write([]byte(fmt.Sprintf("rule:%d", m.ruleIndex)))

	for _, zone := range rule.Zones {
		h.Write([]byte(zone))
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Simplify the rule: reduce the number of OR branches inside AND groups, or split it into several smaller rules
2. Avoid deep and/or nesting — each OR multiplied inside an AND multiplies the group count

When it happens

Trigger: Thrown at pkg/appsec/appsec_rule/modsecurity.go:219 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/24dae7a742f8ae8f. Report an issue: GitHub.