This release adds ServiceNow ticketing, expands API scan coverage, and helps scans run more reliably with less memory.
Track security issues in ServiceNow
Connect Burp Suite DAST to ServiceNow to raise tickets directly from issues, link issues to existing tickets, or automate ticket creation based on severity, confidence, and site. Actions let you choose the destination table and ticket fields, with required fields read from ServiceNow.
Track ticket status and priority from each issue, and see linked tickets in the Linked tickets column. If automatic ticket creation fails, the issue and connection show the reason. You can set up multiple connections using a username and password or OAuth client credentials.
Scan more of your SOAP APIs
Burp Suite DAST now scans more operations and inputs defined in WSDL files. It builds requests in the format your SOAP service expects, helping scan payloads reach the application.
Coverage now includes nested values, inherited fields, XML attributes, SOAP headers, and operations that use common XML Schema types such as 64-bit integers, URIs, and durations. Allowed values, defaults, and limits from the WSDL are offered as parameter values. Existing SOAP sites retain their stored endpoints and settings.
Other improvements
We made the following improvements:
- Reuse site settings. Copy settings from an existing site when creating a new one.
- Review issue evidence in one place. Requests, responses, and other evidence now appear in a single Evidence tab.
- Prevent scope rules that include every host. Advanced scope now rejects these in-scope rules. Scans for sites with an existing rule fail with a message explaining how to fix it.
- Run scans with less memory. Scans reduce active workers under memory pressure, handle requests that run out of memory without freezing, and produce smaller project files.
Java update
We updated Java Runtime to 21.0.13 and Azul Zulu to 21.54.107.
Bug fixes
We fixed the following bugs:
- Dynamic authentication no longer includes quotation marks when sending a token returned as a bare JSON string.
- Responses with
nosniffand no content type are no longer reported as exploitable cross-site scripting. - A failed crawl no longer discards the audit of content already crawled.
- The audit phase no longer stalls if closing a browser tab fails.
- Auto-throttle now backs off as intended.
- Browser failures caused by low memory are now reported as low-memory errors.
- Checks that send no payloads no longer incorrectly attribute the problem to the scan configuration.
- Scans that previously displayed an error when opened in the user interface now load correctly.