CVE-2026-114100: Improper Input Validation in corazawaf coraza

CVE-2026-114100 affects Coraza WAF versions >=3.0.4 and <3.8.1. The vulnerability arises from improper input validation in the request-body processor selection logic, which requires an exact match of the Content-Type header. When the Content-Type includes media-type parameters such as charset=UTF-8, the request body is not parsed, enabling attackers to bypass body inspection rules. This bypass allows unauthenticated attackers to send malicious payloads that evade detection by ARGS_POST and REQUEST_BODY rules, while the backend still processes the payload normally.

An unauthenticated attacker can bypass request body inspection rules by exploiting the Content-Type header matching logic. This allows evasion of security controls that rely on ARGS_POST and REQUEST_BODY data, potentially enabling malicious payloads to reach the backend uninspected. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity), indicating a significant risk of bypass without requiring authentication or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be aware of this bypass vector and consider additional inspection or validation mechanisms outside the vulnerable versions. Avoid deploying Coraza versions >=3.0.4 and <3.8.1 in environments where this risk is unacceptable.