VulnSea

corazawaf has 20 CVEs on record. Disclosure cadence is accelerating: 20 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 20. The median CVSS is 5.8 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-20 (9) and CWE-436 (7). Most affected products: github.com/corazawaf/coraza/v3 (19), coraza (1).

CVEs per month

Last 12 months, by publish date

111201020304050607080910
Exploited share
0% vs 1% corpus
Median CVSS
5.8
Publish → KEV
—
Last 90 days
20 prev 0

Products

  • github.com/corazawaf/coraza/v3 19
  • coraza 1
Follow corazawaf:RSS feedSave a search →Embed badge ↗
20
Total CVEs
0
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

corazawaf vulnerabilities

CVEs affecting corazawaf, newest first. Open any entry for full detail, references, and exploit status.

20 CVEsRSS

CVE-2026-114100Medium· 5.8
6d ago

Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are…

▾ Sunlitcorazawaf · corazaEPSS 0.28%via CVEORG
CVE-2026-104774Medium· 5.8PoC
2w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causin…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.32%via NVD
CVE-2026-41504Medium· 5.8PoC
2w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without n…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.36%via NVD
CVE-2026-41510High· 7.2PoC
2w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/url…

▾ Midnightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.38%via NVD
CVE-2026-41508Medium· 5.8
2w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPAR…

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.50%via NVD
CVE-2026-107835Medium· 4.0PoC
2w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.30%via NVD
CVE-2026-107825Medium· 4.0PoC
2w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUER…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.32%via NVD
CVE-2026-107834Medium· 5.3
2w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each te…

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.32%via NVD
CVE-2026-107833Medium· 5.9PoC
2w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recur…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.39%via NVD
CVE-2026-107826High· 7.5PoC
2w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte b…

▾ Midnightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.46%via NVD
CVE-2026-114099Medium· 5.8
2w ago

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.20%via OSV
CVE-2026-114101Medium· 4.0PoC
2w ago

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.25%via OSV
GHSA-6gcq-wc29-5xf2High· 7.5
2w ago

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3via OSV
GHSA-5gj4-9gm7-2fx2Medium· 5.8
2w ago

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV
GHSA-x26q-wvhg-fh4mMedium· 4.0
2w ago

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV
GHSA-g4qm-m288-5cp9Medium· 4.0
2w ago

Coraza has Cookie Parser Confusion

Coraza has Cookie Parser Confusion

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV
GHSA-3wr7-993q-jrffMedium· 4.0
2w ago

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV
GHSA-3c6w-j9xm-8h2hMedium· 5.9
2w ago

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV
GHSA-w253-m66g-rx24Medium· 5.8
2w ago

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV
GHSA-rp9v-7xv3-r6g3Medium· 5.3
2w ago

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV
corazawaf vulnerabilities (CVEs) · VulnSea