AWS WAF Blocks Media Library AJAX Pagination URLs

Can you verify on 10.2 please?

With the clean install of 10.2.3, the Media Library URL may extend beyond 2000 characters when navigating through pages.

This isn't a bug in Drupal, just a false positive in the WAF. I've also run into this as I have sites behind AWS WAF and have had to add exceptions for this rule and the media library URLs (as an aside, editing content in Drupal often triggers false positives in other WAF rules such as XSS, this is not a bug either).

There are lots of different resources to refer to here, but the most up to date standard from https://stackoverflow.com/questions/417142/what-is-the-maximum-length-of... says

It is RECOMMENDED that all senders and recipients support, at a minimum, URIs with lengths of 8000 octets in protocol elements.

so Drupal is not technically doing anything wrong here.

As already reported here https://www.drupal.org/project/drupal/issues/3403077 🐛 media_library_opener leads to massive GET requests that break varnish etc. Active , GET requests also break Varnish.

Well yes, but that's a separate issue; the AWS WAF does not use Varnish.