CVE-2026-114099: Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-21 · updated 2026-10-28
Weakness: CWE-20

Description

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Affected products

Go Github.Com/Corazawaf/Coraza/V3: from 3.0.0 before 3.8.1 — fixed in 3.8.1
corazawaf coraza: from 3.0.0 before 3.8.1 — fixed in 3.8.1

How to fix

Upgrade to a fixed version: Go Github.Com/Corazawaf/Coraza/V3 3.8.1; corazawaf coraza 3.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-114099 or the next vulnerability affects your stack