V3: Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields (CVE-2026-41504)

Coraza WAF's native audit-log format writes attacker-controlled bytes from request headers, request body, response body, response headers, error messages, and matched-rule data directly into the audit log without escaping CR (\r) or LF (\n) characters. The audit log uses line-based sections delimited by randomized prefixes, and injected newlines break this structure, allowing attackers to insert forged log entries. This compromises the integrity of individual audit records, enabling log forgery that can mislead human operators and automated SIEM correlation. The vulnerability does not allow forging entire separate sessions due to unpredictable session prefixes but fully compromises single-record integrity. The JSON and OCSF audit log formats are not affected as they escape these characters properly. The vulnerability affects Coraza versions >=3.0.0 and <3.8.0. A fix is available that escapes CR and LF characters in all raw-write audit log sites.

An attacker able to inject CRLF sequences into request or response fields logged by Coraza can forge audit log entries, misleading defenders by shifting attribution or confusing SIEM tools. This can break log parsing and hide real incidents by burying genuine alerts under attacker-controlled noise. While forging entire separate sessions is prevented by unpredictable session prefixes, the integrity of individual audit records is compromised, which is sufficient to disrupt incident analysis and response.

A patch is available that escapes carriage return and newline characters in all raw-write audit log fields in Coraza's native audit-log format. Users should upgrade to a fixed version >=3.8.0 or apply the vendor's official fix. Until patched, avoid using the native audit-log format or restrict inputs to prevent injection of CRLF sequences. The JSON and OCSF audit log formats are not affected and can be used as safer alternatives.