Bug: Expand maxmimum upload size

[MorganKryze]

TLDR

Trying to upload files through a service, everything above 10Mb returns me 403 Forbidden.

Situation & steps

VPS setup:

• Pangolin v1.7.3 (crowdsec v1.6.10, traefik v3.4.4)
• Filebrowser v2.40.2

From my laptop, when trying to upload files under (around) 10Mb, everything works correctly.
Above (around) 10Mb, the file(s) try to upload in a cycle of one to three times, then crashes. The file(s) is not uploaded, or some are if multiple files.

Leads

Filebrowser is a service I am used to, and I knwo for sure that it can handle more than 10Mb transfers.

My assumption is that Crowdsec is responsible for this issue. The size of the packet outranges a maximum set somewhere, then with multiple tries, flag my ip and ban it for 4h (default) with a 403 Forbidden error.

This is an extract of a repetitive log message i get from the crowdsec instance whenever I try to upload a large file.

crowdsec  | time="2025-07-21T22:59:28Z" level=warning msg="Disrupting transaction with body size above the configured limit (Action Reject)" band=outband chain_rule_id=749632433 name=myAppSecComponent runner_uuid=faefd14f-c*****************7fc9ede6c tx_id=d1c1621d-3****************9080e7d7ef type=appsec

I guess that there should be a setting somewhere to change this maximum value, but cannot find it up until now.

I may be clumsy, if you need any more information about the config or the logs... feel free to ask!
Thanks for the help :) Fantastic tool btw

[oschwartz10612]

Hi! Yes this is a crowdsec issue. I think it has a 10MB limit on appsec. Check out the following:

https://docs.crowdsec.net/docs/next/configuration/crowdsec_configuration/
https://app.crowdsec.net/hub/author/maxlerebourg/remediation-components/crowdsec-bouncer-traefik-plugin

I think you would want to play with increasing the CrowdsecAppsecBodyLimit value. https://github.com/fosrl/pangolin/pull/515/files

[MorganKryze]

Hi!
Thank you for the quick response

• I tried to tweak with the crowdsecAppsecBodyLimit: 10485760 value, ranging up to 100GB, restarting Traefik, crowdsec or the entire stack or even the VPS did not change a thing.
• Following your first links, I tried to upgrade the traefik bouncer plugin from 1.4.2 to 1.4.4 (latest). No results.

On thing from https://app.crowdsec.net/hub/author/maxlerebourg/remediation-components/crowdsec-bouncer-traefik-plugin that I might understand is that CrowdsecAppsecBodyLimit is indeed limiting the traffic going to crowdsec, so putting it to a high/very high value would do the job, but it's not the case for me.

CrowdsecAppsecBodyLimit:
- int64
- default: 10485760 (= 10MB)
- Transmit only the first number of bytes to Crowdsec Appsec Server.

I may have missed something on my end