CVE-2025-29914 OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`
Attackers can bypass WAF rules by crafting URIs with double slashes, causing incorrect filename parsing in OWASP Coraza.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-29914?
CVE-2025-29914 is a medium-severity vulnerability in corazawaf coraza, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUEST_FILENAME. For example, if the URI //bar/uploads/foo.php?a=b is passed to coraza: , REQUEST_FILENAME will be set to /uploads/foo.php. This can lead to a rules bypass. This vulnerability is fixed in 3.3.3.
Weakness: CWE-706
Which versions are affected by CVE-2025-29914?
8 open source packages ship an affected version, including github.com/corazawaf/coraza/v3, github.com/corazawaf/coraza and github.com/corazawaf/coraza/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/corazawaf/coraza/v3 Go | All versions | 3.3.3 |
github.com/corazawaf/coraza/v3 Go | All versions | 3.3.3 |
github.com/corazawaf/coraza/v3 Go | All versions | 3.3.3 |
github.com/corazawaf/coraza Go | All versions | None |
github.com/corazawaf/coraza/v2 Go | All versions | None |
github.com/jptosso/coraza-waf Go | All versions | None |
2 more packages
github.com/jptosso/coraza-waf Go | All versions | 3.3.3 |
github.com/jptosso/coraza-waf Go | All versions | 3.3.3 |
How do I fix CVE-2025-29914?
Upgrade github.com/corazawaf/coraza/v3 to 3.3.3 or later.
Is CVE-2025-29914 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29914 exists.
Sources
Also known as GHSA-q9f5-625g-xm39, GO-2025-3537.