# github.com/corazawaf/coraza (Go) vulnerabilities

13 known vulnerabilities (2 high, 11 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/corazawaf/coraza

## Advisories (13)

### [CVE-2026-114101](https://cve.now/CVE-2026-114101): Coraza before 3.8.1 Multipart filename\* Charset Handling FILES Rule Bypass

- Severity: Medium 6.3
- Published: Oct 21, 2026
- Affected: all versions.

### [CVE-2026-114100](https://cve.now/CVE-2026-114100): Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

- Severity: Medium 6.9
- Published: Oct 21, 2026
- Affected: all versions.

### [CVE-2026-114099](https://cve.now/CVE-2026-114099): Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

- Severity: Medium 6.9
- Published: Oct 21, 2026
- Affected: all versions.

### [CVE-2026-41508](https://cve.now/CVE-2026-41508): OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART\_STRICT\_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

- Severity: Medium 5.8
- Published: Oct 12, 2026
- Affected: all versions.

### [CVE-2026-41504](https://cve.now/CVE-2026-41504): OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields

- Severity: Medium 5.8
- Published: Oct 12, 2026
- Affected: all versions.

### [CVE-2026-104774](https://cve.now/CVE-2026-104774): OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

- Severity: Medium 5.8
- Published: Oct 12, 2026
- Affected: all versions.

### [CVE-2026-41510](https://cve.now/CVE-2026-41510): OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

- Severity: High 7.2
- Published: Oct 12, 2026
- Affected: all versions.

### [CVE-2026-107835](https://cve.now/CVE-2026-107835): OWASP Coraza WAF: Cookie Parser Confusion

- Severity: Medium 4.0
- Published: Oct 9, 2026
- Affected: all versions.

### [CVE-2026-107834](https://cve.now/CVE-2026-107834): OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

- Severity: Medium 5.3
- Published: Oct 9, 2026
- Affected: all versions.

### [CVE-2026-107833](https://cve.now/CVE-2026-107833): OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

- Severity: Medium 5.9
- Published: Oct 9, 2026
- Affected: all versions.

### [CVE-2026-107826](https://cve.now/CVE-2026-107826): OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

- Severity: High 7.5
- Published: Oct 9, 2026
- Affected: all versions.

### [CVE-2026-107825](https://cve.now/CVE-2026-107825): OWASP Coraza WAF: ProcessURI silently drops QUERY\_STRING and ARGS\_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

- Severity: Medium 4.0
- Published: Oct 9, 2026
- Affected: all versions.

### [CVE-2025-29914](https://cve.now/CVE-2025-29914): OWASP Coraza WAF has parser confusion which leads to wrong URI in \`REQUEST\_FILENAME\`

- Severity: Medium 5.4
- Published: Mar 20, 2025
- Affected: all versions.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/corazawaf/coraza
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.