Corazawaf vulnerabilities

Products

• Coraza 14

Newest

• corazawaf coraza OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor CVE-2026-107834 Fix available 5.3 MediumOctober 8, 2026
• corazawaf coraza Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type CVE-2026-114100 Fix available 6.9 MediumOctober 8, 2026
• corazawaf coraza OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion CVE-2026-107833 Fix available 5.9 MediumOctober 8, 2026
• corazawaf coraza Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass CVE-2026-114101 Public exploitFix available 6.3 MediumOctober 8, 2026
• corazawaf coraza OWASP Coraza WAF: Cookie Parser Confusion CVE-2026-107835 Fix available 4.0 MediumOctober 8, 2026
• corazawaf coraza OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations CVE-2026-107825 Fix available 4.0 MediumOctober 8, 2026
• corazawaf coraza OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass CVE-2026-104774 Fix available 5.8 MediumOctober 8, 2026
• corazawaf coraza OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) CVE-2026-107826 Fix available 7.5 HighOctober 8, 2026
• corazawaf coraza Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision CVE-2026-114099 Fix available 6.9 MediumOctober 8, 2026
• corazawaf coraza OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding CVE-2026-41510 Fix available 7.2 HighOctober 6, 2026
• corazawaf coraza OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling CVE-2026-41508 Fix available 5.8 MediumOctober 6, 2026
• corazawaf coraza OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields CVE-2026-41504 Fix available 5.8 MediumOctober 6, 2026
• corazawaf coraza OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` CVE-2025-29914 Fix available 5.4 MediumMarch 20, 2025
• coraza go package github.com/corazawaf/coraza is vulnerable to denial of service CVE-2023-40586 Fix available 7.5 HighJune 26, 2023