CVE-2026-107835: CWE-436: Interpretation Conflict in corazawaf coraza

OWASP Coraza WAF, a golang modsecurity-compatible web application firewall library, contains a vulnerability in its internal cookie parsing logic prior to version 3.8.1. The function internal/cookies.ParseCookies handles boundary ASCII control characters and control-only or empty cookie names differently compared to several backend cookie parsers. This discrepancy allows an unauthenticated attacker to craft a Cookie header that causes Coraza to index or drop cookies under different names or values than the backend application sees. As a result, security rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES may fail to detect attacker-controlled cookie data. The exploitability depends on the backend parser behavior and the scope of affected rules. The issue is resolved in Coraza version 3.8.1.

An attacker can bypass certain Coraza WAF rules that inspect cookies by exploiting differences in cookie parsing between Coraza and the backend application. This may lead to attacker-controlled cookie data not being detected or blocked by the WAF, potentially allowing malicious requests to reach the backend. There is no impact on confidentiality or availability, and exploitation requires crafting specific Cookie headers. The vulnerability does not affect integrity of data but can reduce the effectiveness of the WAF's cookie-based protections.

Upgrade Coraza WAF to version 3.8.1 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in version 3.8.1.