CVE-2026-107825: CWE-20: Improper Input Validation in corazawaf coraza

Coraza WAF, a Go-based ModSecurity-compatible web application firewall library, improperly handles malformed URIs in versions 3.0.0 up to but not including 3.8.0. Specifically, when the ProcessURI function in internal/corazawaf/transaction.go encounters a failure in url.ParseRequestURI, it retains the raw URI but leaves QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. This discrepancy allows an unauthenticated attacker to embed control bytes in a URI via certain integrations (e.g., coraza-spoa, coraza-proxy-wasm, custom FFI hosts, WASM hosts) to bypass rules that rely on these variables. The bundled coraza/v3/http integration is not affected because it uses Go net/http, which rejects malformed request targets before Coraza processes them. The vulnerability is resolved in Coraza version 3.8.0.

An unauthenticated attacker can bypass security rules that inspect query parameters by exploiting the improper handling of malformed URIs, potentially allowing malicious requests to reach downstream components unchecked. There is no direct confidentiality or availability impact reported, but the integrity of rule enforcement is compromised.

Upgrade Coraza WAF to version 3.8.0 or later, where this issue is fixed. No other mitigations are specified. Since this is a library vulnerability affecting certain integrations, ensure that all Coraza-based integrations are updated accordingly.