BunkerWeb
bunkerweb.ioSelf-Hosted
BunkerWeb is an open-source Next-Generation Web Application Firewall (WAF). It provides easy protection for your web services and is designed to remain secure by default. It integrates seamlessly with modern environments (Docker, Kubernetes, Linux, etc.).
- Homepage:bunkerweb.io
- GitHub:github.com/bunkerity/bunkerweb
- Web info:web-check.xyz/check/bunkerweb.io
BunkerWeb Source Code
Author
Description
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
Homepage
https://www.bunkerweb.ioRepository
- LicenseAGPL-3.0
- Created20 Aug 19
- Primary languagePython
- Size941,589 KB
- Stars10,831
- Forks636
- Watchers10,831
Top Contributors
@TheophileDiot (6623)
@fl0ppy-d1sk (1980)
@syrk4web (877)
@dependabot[bot] (595)
@thelittlefireman (36)
@Hado-K3n (15)
@tomkolp (14)
@Anadris (12)
@Michal-Koeckeis-Fresel (10)
@lenglet-k (10)
@adren (7)
@Copilot (7)
@gin-gitaxias (7)
@wiseweb-works (4)
@Marvo2011 (4)
@mromanelli9 (3)
@jbbandos (3)
@Simonmiz (3)
@TomVivant (3)
@AxyFr (3)
@rayshoo (3)
@ajarmoszuk (3)
@sachin-vcs (3)
@Brawdunoir (2)
@spwoodcock (2)
@nimro27 (2)
@Crazy3lf (2)
@aptkzzz (1)
@vepito (1)
@peterkimzz (1)
@killmasta93 (1)
@jonas0b1011001 (1)
@immanuwell (1)
@harshadkhetpal (1)
@ZILosoft (1)
@Arakmar (1)
@PathToLife (1)
@Nakinox (1)
@Myzel394 (1)
@mevenG (1)
@Pizmovc (1)
@Kn-ut99 (1)
@eltociear (1)
@HongyiHank (1)
@FacundoAcevedo (1)
@ff6347 (1)
@cleverguns (1)
@Ablablab (1)
@kovacs-andras (1)
@aizatto (1)
Recent Commits
Merge pull request #3727 from bunkerity/dev Road to 1.6.13 🚀
fix(instances): harden hostname parsing
Add migration scripts for upgrading to version 1.6.13 across MariaDB, MySQL, PostgreSQL, and SQLite
Road to 1.6.13 🚀
Merge pull request #3720 from bunkerity/dependabot/terraform/tests/terraform/dev/scaleway/scaleway-2.79.0 deps/terraform: bump scaleway/scaleway from 2.78.0 to 2.79.0 in /tests/terraform
Merge pull request #3723 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.319.0 deps/gha: bump ruby/setup-ruby from 1.316.0 to 1.319.0
Merge pull request #3722 from bunkerity/dependabot/github_actions/dev/softprops/action-gh-release-3.0.2 deps/gha: bump softprops/action-gh-release from 3.0.1 to 3.0.2
Merge pull request #3721 from bunkerity/dependabot/github_actions/dev/actions/setup-node-7.0.0 deps/gha: bump actions/setup-node from 6.4.0 to 7.0.0
build: bump base image digests, drop stale CVE pins from AIO/bw Dockerfile
security: Bump nginx to 1.30.4, vendor full source tree
deps/gha: bump ruby/setup-ruby from 1.316.0 to 1.319.0 Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1.316.0 to 1.319.0. - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/d45b1a4e94b71acab930e56e79c6aa188764e7f9...003a5c4d8d6321bd302e38f6f0ec593f77f06600) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.319.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
deps/gha: bump softprops/action-gh-release from 3.0.1 to 3.0.2 Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...3d0d9888cb7fd7b750713d6e236d1fcb99157228) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
deps/gha: bump actions/setup-node from 6.4.0 to 7.0.0 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
deps/terraform: bump scaleway/scaleway in /tests/terraform Bumps [scaleway/scaleway](https://github.com/scaleway/terraform-provider-scaleway) from 2.78.0 to 2.79.0. - [Release notes](https://github.com/scaleway/terraform-provider-scaleway/releases) - [Commits](https://github.com/scaleway/terraform-provider-scaleway/compare/v2.78.0...v2.79.0) --- updated-dependencies: - dependency-name: scaleway/scaleway dependency-version: 2.79.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev
fix(configs): delete custom configs by exact key instead of method-wide
Merge pull request #3718 from bunkerity/dependabot/github_actions/dev/docker/login-action-4.4.0 deps/gha: bump docker/login-action from 4.2.0 to 4.4.0
Merge pull request #3717 from bunkerity/dependabot/github_actions/dev/github/codeql-action/analyze-4.37.0 deps/gha: bump github/codeql-action/analyze from 4.36.3 to 4.37.0
Merge pull request #3715 from bunkerity/dependabot/github_actions/dev/github/codeql-action/upload-sarif-4.37.0 deps/gha: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0
Merge pull request #3714 from bunkerity/dependabot/github_actions/dev/docker/setup-buildx-action-4.2.0 deps/gha: bump docker/setup-buildx-action from 4.1.0 to 4.2.0
Merge pull request #3713 from bunkerity/dependabot/github_actions/dev/github/codeql-action/init-4.37.0 deps/gha: bump github/codeql-action/init from 4.36.3 to 4.37.0
chore(deps): bump Python dependencies across api/autoconf/deps/scheduler
docs(country): reformat README tables for COUNTRY_IGNORE_URI column width
feat(country): add COUNTRY_IGNORE_URI setting to bypass country checks
fix(ui): add reverse proxy buffering settings to UI configuration
fix(deps): bump curl to 8.20.0-r0 in bw/all-in-one images to patch CVEs
feat(limit): add global aggregate rate limit for services Per-IP/per-URL limiting doesn't protect origin capacity from combined traffic across all clients and URLs. Add `USE_LIMIT_REQ_GLOBAL` / `LIMIT_REQ_GLOBAL_RATE` as a cheap O(1) circuit-breaker checked before existing limits, with Redis and local fixed-window counters, UI metric surfacing, and docs across all locales.
fix(instances): validate hostnames against SSRF-style URL smuggling
fix(ui): enforce exact TOTP endpoint check for 2FA gate
deps/gha: bump docker/login-action from 4.2.0 to 4.4.0 Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
BunkerWeb Security
Security Advisories (10)
- mediumPatchedCVSS 5.4
GHSA-j63f-j59c-q626TOTP recovery codes can be rotated before second-factor validation
- highPatchedCVSS 8.8
GHSA-cc8g-89qq-j9vmAuthenticated remote code execution via malicious plugin upload — arbitrary Python code executed via SourceFileLoader
- mediumPatchedCVSS 5.4
CVE-2026-61718Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes
- lowPatchedCVSS 3.8
GHSA-rwch-jhxx-cx5fImproper Hostname Validation Allows Outbound Request Redirection (Potential SSRF) via @ Injection in Instance Registration
- mediumPatched
CVE-2026-54728Authenticated privilege escalation via Host header handling in BunkerWeb UI and API
- highPatchedCVSS 8.8
GHSA-4wcx-xgv7-fjq8Security Vulnerability Report: Path Traversal in UI Plugin Refresh
- mediumPatchedCVSS 5.9
GHSA-q54j-5484-pvjmrDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, whitelist and antibot
- highPatchedCVSS 8.1
GHSA-79fm-4xj6-pp5gArbitrary File Write/Delete via Path Traversal in BunkerWeb Let's Encrypt API
- lowPatchedCVSS 3.5
CVE-2025-8066CVE-2025-8066 – Open Redirect vulnerability in BunkerWeb UI 1.6.X (< 1.6.4)
- lowPatched
CVE-2024-53264Open Redirect Vulnerability in Loading Page
BunkerWeb Website
Website
BunkerWeb - The open-source Web Application Firewall (WAF)
Fool attackers and protect your web services with BunkerWeb, the open-source and next-gen Web Application Firewall (WAF).
Redirects
Does not redirect
Security Checks
All 65 security checks passed
Server Details
- IP Address51.159.125.247
- Hostname51-159-125-247.rev.poneytelecom.eu
- LocationParis,Ile-de-France,France,EU
- ISPScaleway SAS
- ASNAS12876
Associated Countries
FR
NL
Safety Score
Website marked as safe
100%
Blacklist Check
www.bunkerweb.io was found on 0 blacklists
- AntiSocial Blacklist
- Artists Against 419
- Badbitcoin
- Bambenek Consulting
- CERT Polska
- CoinBlockerLists
- CRDF
- CryptoScamDB
- EtherAddressLookup
- EtherScamDB
- Fake Website Buster
- MetaMask EthPhishing
- NABP Not Recommended Sites
- OpenPhish
- PetScams
- PhishFeed
- PhishFort
- Phishing.Database
- PhishStats
- PhishTank
- Phishunt
- RPiList Not Serious
- Scam.Directory
- SecureReload Phishing List
- Spam404
- StopGunScams
- Suspicious Hosting IP
- ThreatFox
- ThreatLog
- TweetFeed
- URLhaus
- ViriBack C2 Tracker
Website Preview
BunkerWeb Reviews
More Firewalls
AFWall+
(Android - Rooted)
xdaforums.com/t/5-0-root-3-6-0-afwall-iptables-firewall-28-aug-2023.1957231Android Firewall+ (AFWall+) is an advanced iptables editor (GUI) for rooted Android devices, which provides very fine-grained control over which Android apps are allowed to access the network.
Open source GUI firewall for Linux, allowing you to block internet access for certain applications. Supports both simple and advanced mode, GUI and CLI options, very easy to use, lightweight/ low-overhead, under active maintenance and backed by a strong community.
IPFire is a hardened, versatile, state-of-the-art Open Source firewall based on Linux. Easy to install on a raspberry Pi, since it is lightweight and heavily customizable.
A very polished application firewall, allowing you to easily manage internet connections on a per-app basis. (Mac OS)
Not Open SourceFirewall app for iPhone, allowing you to block any connection to any domain.
Not Open SourceFree, open source macOS firewall. It aims to block unknown outgoing connections, unless explicitly approved by the user.
Provides simple and advanced ways to block access to the internet. Applications and addresses can individually be allowed or denied access to Wi-Fi and/or mobile connection.
Makes internet connections from all apps visible, allowing you to block or manage traffic on a per-app basis. GNU/Linux port of the Little Snitch application firewall.
Enterprise firewall and router for protecting networks, built on the FreeBSD system.
An open-source ad-blocker and firewall app for Android 6+ (does not require root).
An open source firewall tool for Linux that builds upon the Netfilter system built into the Linux kernel, making it easier to manage more complex configuration schemes with iptables.
Tool to control Windows Filtering Platform (WFP), in order to configure detailed network activity on your PC. (Windows)
The ufw (Uncomplicated Firewall) is a GUI application and CLI, that allows you to configure a firewall using
iptablesmuch more easily.
About the Data: BunkerWeb
Change History
- Added #378
Edit BunkerWeb Data
You can edit BunkerWeb's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access BunkerWeb's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/bunkerwebThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share BunkerWeb
Help your friends compare Firewalls, and pick privacy-respecting software and services.
Share BunkerWeb and Awesome Privacy with your network!