Skip to content
OpenAdvisories

Package · Go

github.com/jptosso/coraza-waf

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.4
    CVE-2025-29914

    OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUEST_FILENAME. For example, if the URI //bar/uploads/foo.php?a=b is pass…

    corazawaf coraza github.com/corazawaf/coraza/v2 github.com/corazawaf/coraza/v3 Go