WAF - WAF Release - 2025-07-28

This week’s update spotlights several vulnerabilities across Apache Tomcat, MongoDB, and Fortinet FortiWeb. Several flaws related with a memory leak in Apache Tomcat can lead to a denial-of-service attack. Additionally, a code injection flaw in MongoDB's Mongoose library allows attackers to bypass security controls to access restricted data.

Key Findings

• Fortinet FortiWeb (CVE-2025-25257): An improper neutralization of special elements used in a SQL command vulnerability in Fortinet FortiWeb versions allows an unauthenticated attacker to execute unauthorized SQL code or commands.

• Apache Tomcat (CVE-2025-31650): A improper Input Validation vulnerability in Apache Tomcat that could create memory leak when incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request.

• MongoDB (CVE-2024-53900, CVE:CVE-2025-23061): Improper use of $where in match and a nested $where filter with a populate() match in Mongoose can lead to search injection.

Impact

These vulnerabilities target user-facing components, web application servers, and back-end databases. A SQL injection flaw in Fortinet FortiWeb can lead to data theft or system compromise. A separate issue in Apache Tomcat involves a memory leak from improper input validation, which could be exploited for a denial-of-service (DoS) attack. Finally, a vulnerability in MongoDB's Mongoose library allows attackers to bypass security filters and access unauthorized data through malicious search queries.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...3461ec9e100804BerriAI - SSRF - CVE:CVE-2024-6587LogDisabledThis is a New DetectionCloudflare Managed Ruleset...0cb13e1d100812Fortinet FortiWeb - Remote Code Execution - CVE:CVE-2025-25257LogBlockThis is a New DetectionCloudflare Managed Ruleset...67fae7f7100813Apache Tomcat - DoS - CVE:CVE-2025-31650LogDisabledThis is a New DetectionCloudflare Managed Ruleset...4b6a5bb1100815MongoDB - Remote Code Execution - CVE:CVE-2024-53900, CVE:CVE-2025-23061LogBlockThis is a New DetectionCloudflare Managed Ruleset...688f8e79100816MongoDB - Remote Code Execution - CVE:CVE-2024-53900, CVE:CVE-2025-23061LogBlockThis is a New Detection