What happened?
The alert ip/range filter checks start_ip, end_ip and ip_size with three separate alert.HasDecisionsWith() predicates, so each bound can be met by a different decision of the same alert. An alert with many decisions, like the community blocklist, matches almost any address.
cscli alerts delete --ip 10.99.0.3 (a local test host) deleted 40 alerts on our LAPI, community blocklist alerts included: active CAPI decisions went from 23994 to 3536 until the next pull.
What did you expect to happen?
Only alerts with a decision that covers the address are matched.
How can we reproduce it?
Create one alert with ban decisions for 1.2.3.4 and 9.9.9.9, then query /v1/alerts?ip=5.5.5.5 or run cscli alerts list --ip 5.5.5.5: the alert is returned. Same for range=5.5.5.0/24&contains=false and for IPv6.
Anything else we need to know?
All the bounds belong in one alert.HasDecisionsWith(...), the way decisionIPv4Filter and decisionIPv6Filter do it for decisions. Fix with a test: AdzerKI@d0671d3b
Crowdsec version
Details
$ cscli version
version: v1.8.1-debian-pragmatic-amd64-909b5157
Codename: alphaga
BuildDate: 2026-09-03_10:57:01
GoVersion: 1.26.3
Platform: linux
pkg/database/alertfilter.go is the same on master.
OS version
Ubuntu 24.04
What happened?
The alert ip/range filter checks
start_ip,end_ipandip_sizewith three separatealert.HasDecisionsWith()predicates, so each bound can be met by a different decision of the same alert. An alert with many decisions, like the community blocklist, matches almost any address.cscli alerts delete --ip 10.99.0.3(a local test host) deleted 40 alerts on our LAPI, community blocklist alerts included: active CAPI decisions went from 23994 to 3536 until the next pull.What did you expect to happen?
Only alerts with a decision that covers the address are matched.
How can we reproduce it?
Create one alert with ban decisions for 1.2.3.4 and 9.9.9.9, then query
/v1/alerts?ip=5.5.5.5or runcscli alerts list --ip 5.5.5.5: the alert is returned. Same forrange=5.5.5.0/24&contains=falseand for IPv6.Anything else we need to know?
All the bounds belong in one
alert.HasDecisionsWith(...), the waydecisionIPv4FilteranddecisionIPv6Filterdo it for decisions. Fix with a test: AdzerKI@d0671d3bCrowdsec version
Details
pkg/database/alertfilter.gois the same on master.OS version
Ubuntu 24.04