# github.com/corazawaf/coraza/v2 (Go) vulnerabilities 14 known vulnerabilities (3 high, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v2.0.1 (Jul 25, 2022): affected by 14 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 3 since v2.0.0 (Mar 22, 2022) - Registry: https://pkg.go.dev/github.com/corazawaf/coraza/v2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114101: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-114100: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-114099: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-41508: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-41504: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-104774: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-41510: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-107835: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-107834: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-107833: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-107826: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2026-107825: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2025-29914: v2.0.0-rc.3 to v2.0.1 (through the newest release) - CVE-2023-40586: v2.0.0-rc.3 to v2.0.1 (through the newest release) ## Advisories (14) ### [CVE-2026-114101](https://cve.now/CVE-2026-114101): Coraza before 3.8.1 Multipart filename\* Charset Handling FILES Rule Bypass - Severity: Medium 6.3 - Published: Oct 21, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-114100](https://cve.now/CVE-2026-114100): Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type - Severity: Medium 6.9 - Published: Oct 21, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-114099](https://cve.now/CVE-2026-114099): Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision - Severity: Medium 6.9 - Published: Oct 21, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-41508](https://cve.now/CVE-2026-41508): OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART\_STRICT\_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling - Severity: Medium 5.8 - Published: Oct 12, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-41504](https://cve.now/CVE-2026-41504): OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields - Severity: Medium 5.8 - Published: Oct 12, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-104774](https://cve.now/CVE-2026-104774): OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass - Severity: Medium 5.8 - Published: Oct 12, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-41510](https://cve.now/CVE-2026-41510): OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding - Severity: High 7.2 - Published: Oct 12, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-107835](https://cve.now/CVE-2026-107835): OWASP Coraza WAF: Cookie Parser Confusion - Severity: Medium 4.0 - Published: Oct 9, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-107834](https://cve.now/CVE-2026-107834): OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor - Severity: Medium 5.3 - Published: Oct 9, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-107833](https://cve.now/CVE-2026-107833): OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion - Severity: Medium 5.9 - Published: Oct 9, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-107826](https://cve.now/CVE-2026-107826): OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) - Severity: High 7.5 - Published: Oct 9, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2026-107825](https://cve.now/CVE-2026-107825): OWASP Coraza WAF: ProcessURI silently drops QUERY\_STRING and ARGS\_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations - Severity: Medium 4.0 - Published: Oct 9, 2026 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2025-29914](https://cve.now/CVE-2025-29914): OWASP Coraza WAF has parser confusion which leads to wrong URI in \`REQUEST\_FILENAME\` - Severity: Medium 5.4 - Published: Mar 20, 2025 - Affected: all versions. - No fix released. The latest release, v2.0.1, is still affected. ### [CVE-2023-40586](https://cve.now/CVE-2023-40586): go package github.com/corazawaf/coraza is vulnerable to denial of service - Severity: High 7.5 - Published: Aug 25, 2023 - Affected: from 2.0.0, through 2.0.1; all versions. - No fix released. The latest release, v2.0.1, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/corazawaf/coraza/v2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.