CVE-2026-104774Medium· 5.8▾ TwilightPoC availableOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causin…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 31.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Exploit / PoC code exists
Last analysed / modified upstream
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/corazawaf/coraza/v3 >= 3.0.0, < 3.8.0Patched in:
github.com/corazawaf/coraza/v3 3.8.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41508Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-107825Medium· 4.0OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-107833Medium· 5.9OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-41504Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-41510High· 7.2OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-107834Medium· 5.3OWASP Coraza WAF is a golang modsecurity compatible web application firewall library