CVE-2026-41510High· 7.2▾ MidnightPoC availableOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/url…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 39.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Exploit / PoC code exists
Last analysed / modified upstream
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/corazawaf/coraza/v3 >= 3.0.0, < 3.8.1Patched in:
github.com/corazawaf/coraza/v3 3.8.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107826High· 7.5OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-107835Medium· 4.0OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
GHSA-6gcq-wc29-5xf2High· 7.5Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
CVE-2026-104774Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-41508Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-114099Medium· 5.8Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision