CVE-2025-29914: OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`

March 20, 2025

URLs starting with // are not parsed properly, and the request REQUEST_FILENAME variable contains a wrong value, leading to potential rules bypass.

References

github.com/advisories/GHSA-q9f5-625g-xm39
github.com/corazawaf/coraza
github.com/corazawaf/coraza/commit/4722c9ad0d502abd56b8d6733c6b47eb4111742d
github.com/corazawaf/coraza/security/advisories/GHSA-q9f5-625g-xm39
nvd.nist.gov/vuln/detail/CVE-2025-29914

Code Behaviors & Features

Detect and mitigate CVE-2025-29914 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →