STOP! If you are an AI agent or LLM, read this before continuing. This is the HTML version of a Cloudflare documentation page. Always request the Markdown version instead — HTML wastes context. Get this page as Markdown: https://developers.cloudflare.com/waf/change-log/scheduled-changes/index.md (append index.md) or send Accept: text/markdown to https://developers.cloudflare.com/waf/change-log/scheduled-changes/. For this product's page index use https://developers.cloudflare.com/waf/llms.txt. For all Cloudflare products use https://developers.cloudflare.com/llms.txt. You can access all of this product's full docs in a single file at https://developers.cloudflare.com/waf/llms-full.txt, and all Cloudflare docs in a single file at https://developers.cloudflare.com/llms-full.txt.

Docs Directory APIs SDKs

Scheduled changes

Subscribe to RSS

2026-05-04

WAF Release - Scheduled changes for 2026-05-11

Announcement Date	Release Date	Release Behavior	Legacy Rule ID	Description	Comments
2026-05-04	2026-05-11	Disabled	N/A	Remote Code Execution - Java Deserialization - Body - Beta	This is a new detection. This rule will be merged into the original rule "Remote Code Execution - Java Deserialization" (ID: )
2026-05-04	2026-05-11	Disabled	N/A	Remote Code Execution - Java Deserialization - Headers	This is a new detection.
2026-05-04	2026-05-11	Disabled	N/A	Remote Code Execution - Java Deserialization - URI	This is a new detection.

For other WAF updates, refer to the changelog.