CVE-2026-107825
MediumCVSS 4.0Summary
OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in ProcessURI in internal/corazawaf/transaction.go that handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. This issue is fixed in version 3.8.0.
Risk Assessment
The risk is bypassing WAF rules, potentially allowing attacks that should be blocked, especially in non-standard integrations.
Recommendation
Upgrade Coraza WAF to version 3.8.0, which contains the fix. Also ensure integrations are aligned with the fix.
Other vulnerabilities in OWASP Coraza WAF
See all- CVE-2026-107835Medium
OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, prior to 3.8.1, has a vulnerability in internal/cookies.ParseCookies that handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. This issue is fixed in version 3.8.1.
- CVE-2026-107834Medium
OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in the multipart loop in internal/bodyprocessors/multipart.go that executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.
- CVE-2026-107833Medium
OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in ProcessResponse in internal/bodyprocessors/json.go that passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. This issue is fixed in version 3.8.0.
- CVE-2023-40586High
OWASP Coraza WAF, a modsecurity compatible web application firewall library, crashes due to misuse of `log.Fatalf`. The application crashes immediately after receiving crafted requests from attackers, triggered by an error in `mime.ParseMediaType`.
Original NVD description (English source)
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. The bundled coraza/v3/http integration is not affected because Go net/http rejects such malformed request targets before calling Coraza. This issue is fixed in version 3.8.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS