Any "SecRule" or CRS rule that inspects "ARGS", "ARGS_GET", "ARGS_NAMES", "ARGS_GET_NAMES", or "ARGS_PATH" can be evaded by inflating the request's argument count past "SecArgumentsLimit" (default "1000"). The bypass probability per request scales with overflow: | Total args in request | Observed bypass rate of ARGS rule | |---|---| | 1000 (at limit) | 0 / 50 (0.0%) | | 1001 (1 over) | 0 / 2000 (< 0.1%) | | 1100 (100 over) | 45 / 500 (9.0%) | | 2000 (1000 over) | 106 / 200 (53.0%) | | 10000 (10× limit) | 47 / 50 (94.0%) | The rate matches the theoretical model "(N − limit) / N". An attacker flooding with 10000 arguments lands a bypass on ~94% of requests; one failed attempt costs them nothing, so a handful of retries yields a near-certain evasion against any ARGS-targeted rule, including the OWASP CRS SQLi, XSS, RCE, and LFI detection families. The issue is silent — operators see no audit-log entry, no error, and no "MULTIPART_STRICT_ERROR"-style flag variable, because none exists.