github.com/corazawaf/coraza/v3
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
View on Github
Activity
- Latest release
- 4w ago
- Total releases
- 22
- Cadence
- ~26 days
- Last 12 months
- 6
Reach
- Stars
- 3.9k
Details
- First release
- Mar 17, 2023
| Version | Released | |
|---|---|---|
v3.8.1
patch
|
v3.8.1
patch
Dependencies (13)
+ 5 more |
|
v3.8.0
minor
6 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev |
v3.8.0
minor
Dependencies (13)
+ 5 more |
|
v3.7.0
minor
12 CVEs
CVE-2026-41508
GO-2026-6670
GHSA-r3rm-qphw-hh76
Oct 20, 2026
Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev |
v3.7.0
minor
Dependencies (14)
+ 6 more |
|
v3.6.0
minor
12 CVEs
CVE-2026-41508
GO-2026-6670
GHSA-r3rm-qphw-hh76
Oct 20, 2026
Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev |
v3.6.0
minor
Dependencies (14)
+ 6 more |
|
v3.5.0
minor
12 CVEs
CVE-2026-41508
GO-2026-6670
GHSA-r3rm-qphw-hh76
Oct 20, 2026
Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev |
v3.5.0
minor
Dependencies (14)
+ 6 more |
|
v3.4.0
minor
12 CVEs
CVE-2026-41508
GO-2026-6670
GHSA-r3rm-qphw-hh76
Oct 20, 2026
Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev |
v3.4.0
minor
Dependencies (14)
+ 6 more |
|
v3.3.3
patch
11 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev |
v3.3.3
patch
Dependencies (13)
+ 5 more |
|
v3.3.2
patch
12 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.3.2
patch
Dependencies (13)
+ 5 more |
|
v3.3.1
patch
12 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.3.1
patch
Dependencies (13)
+ 5 more |
|
v3.3.0
minor
12 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.3.0
minor
Dependencies (13)
+ 5 more |
|
v3.2.2
patch
12 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.2.2
patch
Dependencies (13)
+ 5 more |
|
v3.2.1
patch
12 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.2.1
patch
Dependencies (10)
+ 2 more |
|
v3.2.0
minor
12 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.2.0
minor
Dependencies (10)
+ 2 more |
|
v3.1.0
minor
12 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.1.0
minor
Dependencies (10)
+ 2 more |
|
v3.0.4
patch
12 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114100
GO-2026-6698
GHSA-w253-m66g-rx24
Oct 19, 2026
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.0.4
patch
Dependencies (10)
+ 2 more |
|
v3.0.3
patch
11 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.0.3
patch
Dependencies (10)
+ 2 more |
|
v3.0.2
patch
11 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.0.2
patch
Dependencies (9)
+ 1 more |
|
v3.0.1
patch
11 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v3.0.1
patch
Dependencies (9)
+ 1 more |
|
v3.0.0
initial
12 CVEs
CVE-2026-41510
GO-2026-6668
GHSA-6r3q-mjv7-xr8m
Oct 20, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-41504
GO-2026-6669
GHSA-prpw-wwv7-xjjr
Oct 20, 2026
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 20, 2026 · Source: OSV.dev
CVE-2026-107833
GO-2026-6690
GHSA-3c6w-j9xm-8h2h
Oct 19, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107826
GO-2026-6693
GHSA-6gcq-wc29-5xf2
Oct 19, 2026
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-114099
GO-2026-6692
GHSA-5gj4-9gm7-2fx2
Oct 19, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-104774
GO-2026-6696
GHSA-pc5q-qfxp-ggqv
Oct 19, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107834
GO-2026-6697
GHSA-rp9v-7xv3-r6g3
Oct 19, 2026
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2026-107825
GO-2026-6699
GHSA-x26q-wvhg-fh4m
Oct 19, 2026
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza Fixed in
3.8.0
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2023-40586
GO-2023-1874
GHSA-c2pj-v37r-2p6h
Jul 05, 2023
Denial of service in github.com/corazawaf/coraza/v2 and v3 Due to the misuse of log.Fatalf, Coraza may crash after receiving crafted requests from attackers. Fixed in
3.0.1
References Updated May 20, 2024 · Source: OSV.dev |
v3.0.0
initial
Dependencies (8)
|
|
v3.0.0-rc.3
pre
4 CVEs
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2023-40586
GO-2023-1874
GHSA-c2pj-v37r-2p6h
Jul 05, 2023
Denial of service in github.com/corazawaf/coraza/v2 and v3 Due to the misuse of log.Fatalf, Coraza may crash after receiving crafted requests from attackers. Fixed in
3.0.1
References Updated May 20, 2024 · Source: OSV.dev |
v3.0.0-rc.3
pre
Dependencies (8)
|
|
v3.0.0-rc.2
pre
4 CVEs
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2023-40586
GO-2023-1874
GHSA-c2pj-v37r-2p6h
Jul 05, 2023
Denial of service in github.com/corazawaf/coraza/v2 and v3 Due to the misuse of log.Fatalf, Coraza may crash after receiving crafted requests from attackers. Fixed in
3.0.1
References Updated May 20, 2024 · Source: OSV.dev |
v3.0.0-rc.2
pre
Dependencies (8)
|
|
v3.0.0-rc.1
pre
4 CVEs
CVE-2026-114101
GO-2026-6691
GHSA-3wr7-993q-jrff
Oct 19, 2026
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza Fixed in
3.8.1
References
Updated Oct 21, 2026 · Source: OSV.dev
CVE-2026-107835
GO-2026-6694
GHSA-g4qm-m288-5cp9
Oct 19, 2026
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza Fixed in
3.8.1
References Updated Oct 19, 2026 · Source: OSV.dev
CVE-2025-29914
GO-2025-3537
GHSA-q9f5-625g-xm39
Mar 25, 2025
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in Fixed in
3.3.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2023-40586
GO-2023-1874
GHSA-c2pj-v37r-2p6h
Jul 05, 2023
Denial of service in github.com/corazawaf/coraza/v2 and v3 Due to the misuse of log.Fatalf, Coraza may crash after receiving crafted requests from attackers. Fixed in
3.0.1
References Updated May 20, 2024 · Source: OSV.dev |
v3.0.0-rc.1
pre
Dependencies (7)
|