Bridge WAF
OWASP Top 10:2025: what a WAF can and cannot cover
The OWASP Top 10 is an awareness document from the OWASP Foundation that ranks ten categories of security risk in web applications, and the current edition is 2025. A web application firewall acts on part of it: the categories whose attacks arrive as requests with a recognisable shape or rate. The rest are fixed in code, in configuration and in the build pipeline.
Quick facts
- Published by
- OWASP Foundation
- Current edition
- 2025, checked on 8 October 2026
- Categories
- Ten, numbered A01:2025 to A10:2025
- New in 2025
- A03 Software Supply Chain Failures, widened from 2021's Vulnerable and Outdated Components, and A10 Mishandling of Exceptional Conditions
- Where a WAF helps
- Categories whose attacks arrive as requests: most of A05 Injection, part of A07 Authentication Failures, and recognisable payloads in a few others
Each category groups many individual weaknesses, so a category is a direction to look in. It is not a test you pass or fail.
What OWASP is
OWASP, the Open Worldwide Application Security Project, is a nonprofit foundation that publishes free material on software security. The Top 10 is its best-known document; others include the API Security Top 10, the Core Rule Set and the ModSecurity engine.
OWASP projects are written by volunteers and published openly, which is why vendor pages quote them so often. The organisation does not certify products, so a claim that something is OWASP compliant means only that its maker mapped it to OWASP material.
The ten categories, and where a request filter fits
A request filter sees the request: method, path, headers, body, and how often similar requests arrive. That decides the right-hand column.
| Category | What it covers | What a WAF can do |
|---|---|---|
| A01:2025 Broken Access Control | Users acting outside their permissions; since 2025 it also includes server-side request forgery | Little. Whether a user may see a record is decided inside the application; recognisable forgery payloads can be matched |
| A02:2025 Security Misconfiguration | Insecure defaults, features left switched on, errors that say too much | Little. The fix is configuration; probes for well-known exposed paths can be matched |
| A03:2025 Software Supply Chain Failures | Vulnerable, outdated or compromised components, and the systems that build and ship them | Little. Requests that exploit a known component flaw can be matched while the component is replaced |
| A04:2025 Cryptographic Failures | Data exposed by missing or weak cryptography | Nothing. No request shows it |
| A05:2025 Injection | Input interpreted as a query or a command: SQL, operating system commands, cross-site scripting | Most. The attack travels inside the request, and its shape can be matched |
| A06:2025 Insecure Design | Controls missing from the design itself | Nothing. There is no request pattern for a missing control |
| A07:2025 Authentication Failures | Weak credential handling, session flaws, automated attempts on sign-in | Part. The rate and pattern of sign-in attempts can be limited; session and password handling cannot |
| A08:2025 Software or Data Integrity Failures | Code, updates or data trusted without checking their integrity | Little |
| A09:2025 Security Logging and Alerting Failures | Attacks that are not recorded, or recorded and never acted on | Indirectly. A filter's own log is one of the records this category asks for |
| A10:2025 Mishandling of Exceptional Conditions | Errors handled badly: logic errors, failing open, revealing internals | Nothing. The handling happens inside the application |
Category names and order are from the OWASP Top 10:2025; the right-hand column is this page's reading of what a request filter can observe. The six linked categories have a page of their own here; the other four are fixed in the application and its build. What insecure design looks like in practice is on business logic flaws.
What changed from 2021
The introduction to the 2025 edition lists the changes.
- Server-side request forgery moved into A01. It was its own category in 2021 and is now part of Broken Access Control.
- A03 widened. Vulnerable and Outdated Components became Software Supply Chain Failures, which also covers build systems and distribution.
- A10 is new. Mishandling of Exceptional Conditions covers improper error handling, logic errors and failing open.
- Two names changed. Identification and Authentication Failures became Authentication Failures, and Security Logging and Monitoring Failures became Security Logging and Alerting Failures.
- The order moved. Security Misconfiguration rose to second place; Cryptographic Failures, Injection and Insecure Design each moved down.
Pages that cite 2021 positions by number now point at different categories, which is worth checking before quoting a code.
How to read the list
OWASP calls the Top 10 an awareness document. It ranks categories by how often and how badly they appear, which makes it a good map of where to look and a poor checklist.
That matters when a product says it covers the Top 10. Seven of the ten categories live mostly in code, configuration or the build pipeline, where no request carries a trace of them. A filter in front of the application reaches the request-shaped part of the list, and the rest stays with whoever writes and ships the application.
Where a filter does help with a known weakness, it buys time until the fix lands, which is what virtual patching means.
Questions
Does a WAF cover the OWASP Top 10?
Partly. A WAF can act on the categories whose attacks arrive as requests, mainly injection and automated attempts on sign-in. Categories such as cryptographic failures, insecure design and mishandled errors live in the application and its build, where no request shows them.
What is new in the OWASP Top 10:2025?
Two categories: A03 Software Supply Chain Failures, which widens the 2021 category on vulnerable components, and A10 Mishandling of Exceptional Conditions. Server-side request forgery was folded into A01 Broken Access Control.
Where did SSRF go in the 2025 edition?
Into A01:2025 Broken Access Control. It was a separate category in 2021.
Is the OWASP Top 10 a compliance standard?
No. OWASP describes it as an awareness document: a ranked map of common risk categories, useful for deciding where to look, and not a list of controls to certify against.