github.com/corazawaf/coraza/v3 vulnerabilities
CVEs whose affected-version data names the github.com/corazawaf/coraza/v3 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
17 CVEsRSS
CVE-2026-104774Medium· 5.8PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causin…
CVE-2026-41504Medium· 5.8PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without n…
CVE-2026-41510High· 7.2PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/url…
CVE-2026-41508Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPAR…
CVE-2026-107835Medium· 4.0PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie…
CVE-2026-107825Medium· 4.0PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUER…
CVE-2026-107834Medium· 5.3OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each te…
CVE-2026-107833Medium· 5.9PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recur…
CVE-2026-107826High· 7.5PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte b…
GHSA-6gcq-wc29-5xf2High· 7.5Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
GHSA-5gj4-9gm7-2fx2Medium· 5.8Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection
GHSA-x26q-wvhg-fh4mMedium· 4.0Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
GHSA-g4qm-m288-5cp9Medium· 4.0Coraza has Cookie Parser Confusion
Coraza has Cookie Parser Confusion
GHSA-3wr7-993q-jrffMedium· 4.0Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules
GHSA-3c6w-j9xm-8h2hMedium· 5.9Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion
GHSA-w253-m66g-rx24Medium· 5.8Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection
GHSA-rp9v-7xv3-r6g3Medium· 5.3Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor