Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza

Coraza, a Go web application firewall library, silently drops QUERY_STRING and ARGS_GET when a URI fails to parse in ProcessURI, so WAF rules that inspect query parameters do not see them. An attacker can send crafted URIs that evade query-based rules in integrations that do not use net/http.

Summary written from the sources below. Check the originals before acting.