Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/corazawaf/coraza/v2

14 known vulnerabilities (3 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release
v2.0.1 (Jul 25, 2022): affected by 14 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
14 · 3 high, 11 medium
Releases
3 since v2.0.0 (Mar 22, 2022)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 14 advisoriesShow fewer advisories
  • CVE-2025-29914
    Affects v2.0.0-rc.3 to v2.0.1 (through the newest release)
  • CVE-2023-40586
    Affects v2.0.0-rc.3 to v2.0.1 (through the newest release)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

  • CVE-2026-114101Medium 6.3

    Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2026-114100Medium 6.9

    Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2026-114099Medium 6.9

    Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2026-41508Medium 5.8

    OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2026-41504Medium 5.8

    OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2026-104774Medium 5.8

    OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2026-107835Medium 4.0

    OWASP Coraza WAF: Cookie Parser Confusion

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2026-107834Medium 5.3

    OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2026-107833Medium 5.9

    OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2026-107825Medium 4.0

    OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • CVE-2025-29914Medium 5.4

    OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`

    Affected: all versions.

    No fix released. The latest release, v2.0.1, is still affected.

  • go package github.com/corazawaf/coraza is vulnerable to denial of service

    Affected: from 2.0.0, through 2.0.1; all versions.

    No fix released. The latest release, v2.0.1, is still affected.