EIP-2026-103395

This advisory describes a bypass vulnerability in Airlock WAF where overlong UTF-8 sequences of the NUL character can evade pattern-based attack detection. The PoC demonstrates how SQL injection payloads can bypass the WAF by encoding the NUL byte as C0 80.