—

GO-2025-3537

OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza

Quick fix

GO-2025-3537 — github.com/corazawaf/coraza/v3: upgrade to the fixed version with the command below.

go get github.com/corazawaf/coraza/v3@v3.3.3

Details

OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza

Enter the version of the package you're using.

Introduced in: 0

No fixed version published yet for github.com/corazawaf/coraza (go modules). Pin to a known-safe version or switch to an alternative.

Introduced in: 0

No fixed version published yet for github.com/corazawaf/coraza/v2 (go modules). Pin to a known-safe version or switch to an alternative.

Introduced in: 0Fixed in: 3.3.3

Fixgo get github.com/corazawaf/coraza/v3@v3.3.3

Introduced in: 0

No fixed version published yet for github.com/jptosso/coraza-waf (go modules). Pin to a known-safe version or switch to an alternative.