V3: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

The Coraza JSON body processor uses a bounded recursion function readItems to parse JSON bodies with limits on recursion depth, argument count, and byte budget. However, if the argument limit is reached early, readItems stops processing and returns no error, causing readJSON to call gjson.Valid on the entire raw JSON body. The gjson.Valid function recurses without a depth bound, leading to an unbounded stack overflow and process crash for deeply nested JSON inputs. This vulnerability affects Coraza versions >=3.0.0 and <3.8.1. The crash is a fatal stack overflow error that cannot be recovered by Go's panic/recover mechanism, resulting in process termination.

An unauthenticated attacker can send a specially crafted JSON HTTP request to any endpoint protected by Coraza with the JSON body processor enabled (default for application/json). This triggers a fatal stack overflow crash of the host process, causing denial of service. The crash cannot be caught or mitigated by the integrator, requiring process restart and causing loss of all in-flight requests. The attack payload is smaller than default and recommended body and argument limits, making it practical to exploit.

A patch is available for this vulnerability. Users should upgrade Coraza to version 3.8.1 or later where this issue is fixed. The fix involves adding an explicitly bounded-depth pre-scan or reusing readItems' recursion accounting before calling gjson.Valid to prevent unbounded recursion. Until patched, no effective mitigation exists as the crash is unrecoverable and triggered by default configuration limits.