PT-2025-12364 · Owasp · Owasp Coraza Waf

Published 2025-03-20 · Updated 2025-03-28 · CVE-2025-29914

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions prior to 3.3.3

Description The issue arises when a request is made to an URI starting with //. In such cases, the REQUEST FILENAME is set incorrectly, potentially leading to a rules bypass. For instance, a request to the URI '//bar/uploads/foo.php?a=b' would result in REQUEST FILENAME being set to '/uploads/foo.php'.

Recommendations For versions prior to 3.3.3, update to version 3.3.3 to resolve the issue. As a temporary workaround, consider restricting access to URIs starting with // to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-706

Related Identifiers

BDU:2026-07889

CVE-2025-29914

GHSA-Q9F5-625G-XM39

GO-2025-3537

OPENSUSE-SU-2025:14937-1

Affected Products

Owasp Coraza Waf

References · 46

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29914.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q9f5-625g-xm39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29914 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29914 · Security Note
• https://osv.dev/vulnerability/GO-2025-3537 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07889 · Security Note
• https://github.com/corazawaf/coraza/security/advisories/GHSA-q9f5-625g-xm39 · Note
• https://github.com/corazawaf/coraza/commit/4722c9ad0d502abd56b8d6733c6b47eb4111742d · Note
• https://github.com/corazawaf/coraza · Note
• https://suse.com/security/cve/CVE-2025-29778 · Note
• https://suse.com/security/cve/CVE-2024-9042 · Note
• https://suse.com/security/cve/CVE-2025-24513 · Note
• https://suse.com/security/cve/CVE-2024-53348 · Note
• https://suse.com/security/cve/CVE-2025-24514 · Note