CVE-2026-107833Medium· 5.9▾ TwilightPoC availableOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recur…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Exploit / PoC code exists
Last analysed / modified upstream
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/corazawaf/coraza/v3 >= 3.0.0, < 3.8.0Patched in:
github.com/corazawaf/coraza/v3 3.8.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
GHSA-3c6w-j9xm-8h2hMedium· 5.9Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion
CVE-2026-114101Medium· 4.0Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules
CVE-2026-107825Medium· 4.0OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-107826High· 7.5OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-104774Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-41504Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library