Skip to contentCorazawaf Coraza vulnerabilities
- corazawaf corazaOWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processorCVE-2026-107834Fix available5.3 Medium
- corazawaf corazaCoraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-TypeCVE-2026-114100Fix available6.9 Medium
- corazawaf corazaOWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustionCVE-2026-107833Fix available5.9 Medium
- corazawaf corazaCoraza before 3.8.1 Multipart filename* Charset Handling FILES Rule BypassCVE-2026-114101Public exploitFix available6.3 Medium
- corazawaf corazaOWASP Coraza WAF: Cookie Parser ConfusionCVE-2026-107835Fix available4.0 Medium
- corazawaf corazaOWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationsCVE-2026-107825Fix available4.0 Medium
- corazawaf corazaOWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF BypassCVE-2026-104774Fix available5.8 Medium
- corazawaf corazaOWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)CVE-2026-107826Fix available7.5 High
- corazawaf corazaCoraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key CollisionCVE-2026-114099Fix available6.9 Medium
- corazawaf corazaOWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingCVE-2026-41510Fix available7.2 High
- corazawaf corazaOWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingCVE-2026-41508Fix available5.8 Medium
- corazawaf corazaOWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsCVE-2026-41504Fix available5.8 Medium
- corazawaf corazaOWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`CVE-2025-29914Fix available5.4 Medium
- corazago package github.com/corazawaf/coraza is vulnerable to denial of serviceCVE-2023-40586Fix available7.5 High