Before you manually configure a rule in your WAF you might as well just fix the vulnerability in the vulnerable component directly ^^

especially in free/open source software like edk2