What’s Vulnerable › Products

corazawaf coraza vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your corazawaf coraza version is affected

Latest corazawaf coraza vulnerabilities

• CVE-2026-114100 — Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type (CVSS 5.8)
• CVE-2026-114101 — Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass (CVSS 4.0)
• CVE-2026-114099 — Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision (CVSS 5.8)
• CVE-2026-41508 — OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling (CVSS 5.8)
• CVE-2026-41504 — OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields (CVSS 5.8)
• CVE-2026-41510 — OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding (CVSS 7.2)
• CVE-2026-104774 — OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass (CVSS 5.8)
• CVE-2026-107835 — OWASP Coraza WAF: Cookie Parser Confusion (CVSS 4.0)
• CVE-2026-107834 — OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor (CVSS 5.3)
• CVE-2026-107833 — OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion (CVSS 5.9)
• CVE-2026-107826 — OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) (CVSS 7.5)
• CVE-2026-107825 — OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations (CVSS 4.0)
• CVE-2025-29914 — OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` (CVSS 5.4)
• CVE-2023-40586 — go package github.com/corazawaf/coraza is vulnerable to denial of service (CVSS 7.5)