Track vulnerabilities throughout their lifecycle
Burp Suite DAST now gives every vulnerability a persistent identity that carries across scans. Instead of treating findings as isolated scan results, DAST tracks them as long-lived records with their own status, history, and remediation journey.
You can now view issues through a single, consistent interface, whether you're looking at the dashboard, a folder, a site, or a scan result. Each issue includes a timeline of activity, a scanner status that reflects its current lifecycle stage, and built-in re-testing so you can verify fixes without waiting for a full scan.
Issue records also now include First seen and Last seen dates, making it easier to identify long-standing vulnerabilities, track remediation progress, and prioritise work based on risk and age.
For more information, see Managing issues in Burp Suite DAST and Issue statuses.
Manage issues directly from the Issues list
You can now manage issues without leaving the Issues list. A new Actions column lets you change an issue's severity or status in place, and you can update the status of several issues at once, with a confirmation step where you can add a note explaining the change. You can also raise or link a ticket in any configured integration straight from an issue's detail view, and the link then appears everywhere that issue is shown.
For more information, see Managing issues in Burp Suite DAST.
Supply recorded logins inline in CI/CD scans
If you drive scans from CI/CD, you can now pass recorded login content directly to a scan using the new BURP_RECORDED_LOGIN_SCRIPTS environment variable (or the recordedLoginScripts configuration field), instead of pointing to a file on disk. This makes recorded logins easier to manage with a secret manager and keeps credentials out of your repository. Existing file-based recorded logins continue to work unchanged.
For more information, see Creating a configuration file for a CI-driven scan.
New Integrations section on the Connectivity settings page
The Connectivity settings page now shows a dedicated Integrations section, listing the IP ranges used by integrations separately from the Scanning machines ranges. This makes it clearer which ranges to allow for each purpose. The section appears only in regions where integration IP ranges apply.
Bug fixes
We've fixed the following bugs:
- Some valid Java regular expression constructs, including
(?i)for case-insensitive matching, were not accepted in scope rules. - Scans of Postman, SOAP, and GraphQL API definitions containing unsupported operations could fail or report errors. Partially-supported definitions are now scanned and no longer reported as failed.
- Custom headers were not applied consistently throughout the audit.
- The scanner did not always send the correct
Sec-Fetch-Destheaders. - Scans and active audits could use excessive CPU on large sites.
- The recorded-login editor could accept a TOTP secret and generate valid-looking codes for it, even when the scanner rejected the same secret as invalid. TOTP secrets are now validated consistently.
- On self-hosted deployments, old Burp and JRE files could build up in the server's download directory and use excessive disk space.
Security fixes
We've fixed some security issues.
We recommend upgrading to this release as soon as possible.
Java update
We updated Java Runtime to 21.0.12 and Azul Zulu to 21.52.15.