Security
فارسی
All products

github.com/corazawaf/coraza/v2

Go · Package
14 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspectionCVE-2026-114099 · GHSA-5GJ4-9GM7-2FX2Version ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rulesCVE-2026-114101 · GHSA-3WR7-993Q-JRFFVersion ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspectionCVE-2026-114100 · GHSA-W253-M66G-RX24Version ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingCVE-2026-41508 · GHSA-R3RM-QPHW-HH76Version ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingCVE-2026-41510 · GHSA-6R3Q-MJV7-XR8MVersion ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go High Fix reported
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsCVE-2026-41504 · GHSA-PRPW-WWV7-XJJRVersion ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationsCVE-2026-107825 · GHSA-X26Q-WVHG-FH4MVersion ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processorCVE-2026-107834 · GHSA-RP9V-7XV3-R6G3Version ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza has Cookie Parser ConfusionCVE-2026-107835 · GHSA-G4QM-M288-5CP9Version ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF BypassCVE-2026-104774 · GHSA-PC5Q-QFXP-GGQVVersion ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)CVE-2026-107826 · GHSA-6GCQ-WC29-5XF2Version ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go High Fix reported
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustionCVE-2026-107833 · GHSA-3C6W-J9XM-8H2HVersion ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`CVE-2025-29914 · GHSA-Q9F5-625G-XM39Version ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go Medium Fix reported
Coraza has potential denial of service vulnerabilityCVE-2023-40586 · GHSA-C2PJ-V37R-2P6HVersion ranges need review. github.com/corazawaf/coraza/v2github.com/corazawaf/coraza/v3 Go High Fix reported