[ Vendor · 12 CVEs ]
corazawaf
CVEs affecting corazawaf published in the last 30 days, plus any corazawaf CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114099 | 21 Oct 2026 | CVSS 5.8 | corazawaf corazaCoraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal… | |
| CVE-2026-114100 | 21 Oct 2026 | CVSS 5.8 | corazawaf corazaCoraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type… | |
| CVE-2026-114101 | 21 Oct 2026 | CVSS 4.0 | corazawaf corazaCoraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose… | |
| CVE-2026-41504 | 12 Oct 2026 | CVSS 5.8 | Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in… | Fix |
| CVE-2026-41508 | 12 Oct 2026 | CVSS 5.8 | Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in… | Fix |
| CVE-2026-41510 | 12 Oct 2026 | CVSS 7.2 | Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after… | Fix |
| CVE-2026-104774 | 12 Oct 2026 | CVSS 5.8 | Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF BypassOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in… | Fix |
| CVE-2026-107834 | 9 Oct 2026 | CVSS 5.3 | Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processorOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in… | Fix |
| CVE-2026-107835 | 9 Oct 2026 | CVSS 4.0 | corazawaf corazaOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in… | |
| CVE-2026-107825 | 9 Oct 2026 | CVSS 4.0 | Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationsOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in… | Fix |
| CVE-2026-107826 | 9 Oct 2026 | CVSS 7.5 | Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in… | Fix |
| CVE-2026-107833 | 9 Oct 2026 | CVSS 5.9 | Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustionOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in… | Fix |