Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/corazawaf/coraza/v3

14 known vulnerabilities (3 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release
v3.8.1 (Oct 2, 2026): no advisory affects it
Newest unaffected release
v3.8.1 (Oct 2, 2026), the latest release
Advisories
14 · 3 high, 11 medium
Releases
22 since v3.0.0 (May 31, 2023)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 14 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

  • CVE-2026-114101Medium 6.3

    Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

    Affected: fixed in 3.8.1.

    Fixed in v3.8.1 (released Oct 2, 2026, 19 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2026-114100Medium 6.9

    Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

    Affected: from 3.0.4, fixed in 3.8.1.

    Fixed in v3.8.1 (released Oct 2, 2026, 19 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2026-114099Medium 6.9

    Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

    Affected: from 3.0.0, fixed in 3.8.1.

    Fixed in v3.8.1 (released Oct 2, 2026, 19 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2026-41508Medium 5.8

    OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

    Affected: from 3.4.0, fixed in 3.8.0.

    Fixed in v3.8.0 (released Sep 30, 2026, 12 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2026-41504Medium 5.8

    OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields

    Affected: from 3.0.0, fixed in 3.8.0.

    Fixed in v3.8.0 (released Sep 30, 2026, 12 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2026-104774Medium 5.8

    OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

    Affected: from 3.0.0, fixed in 3.8.0.

    Fixed in v3.8.0 (released Sep 30, 2026, 12 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

    Affected: from 3.0.0, fixed in 3.8.1.

    Fixed in v3.8.1 (released Oct 2, 2026, 10 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2026-107835Medium 4.0

    OWASP Coraza WAF: Cookie Parser Confusion

    Affected: fixed in 3.8.1.

    Fixed in v3.8.1 (released Oct 2, 2026, 7 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2026-107834Medium 5.3

    OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

    Affected: from 3.0.0, fixed in 3.8.0.

    Fixed in v3.8.0 (released Sep 30, 2026, 9 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2026-107833Medium 5.9

    OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

    Affected: from 3.0.0, fixed in 3.8.0.

    Fixed in v3.8.0 (released Sep 30, 2026, 9 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

    Affected: from 3.0.0, fixed in 3.8.1.

    Fixed in v3.8.1 (released Oct 2, 2026, 7 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2026-107825Medium 4.0

    OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

    Affected: from 3.0.0, fixed in 3.8.0.

    Fixed in v3.8.0 (released Sep 30, 2026, 9 days before disclosure).

    The latest release, v3.8.1, is not affected.

  • CVE-2025-29914Medium 5.4

    OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`

    Affected: fixed in 3.3.3.

    Fixed in v3.3.3 (released Mar 20, 2025, the day of disclosure).

    The latest release, v3.8.1, is not affected.

  • go package github.com/corazawaf/coraza is vulnerable to denial of service

    Affected: from 3.0.0, fixed in 3.0.1; fixed in 3.0.1.

    Fixed in v3.0.1 (released Jun 25, 2023, 61 days before disclosure).

    The latest release, v3.8.1, is not affected.