V3: Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

The JSON response body processor in Coraza v3 calls readJSON with a recursion limit constant set to -1, effectively disabling recursion limits on response bodies. The recursion guard in readItems only triggers when the recursion count reaches zero, but since the response path counts down from -1, it never triggers. This allows deeply nested JSON responses to be parsed with unbounded recursion, causing CPU exhaustion due to quadratic complexity in the nesting depth. The request path correctly enforces a recursion limit (default 1024), but the response path discards the recursion limit parameter and uses a constant that disables the guard. Testing shows that processing a 512 KiB JSON response with about 87,000 nesting levels takes approximately 12 seconds of CPU time on a single core.

An attacker can cause high CPU usage and potential denial of service by sending deeply nested JSON responses to a Coraza v3 instance with ResponseBodyAccess enabled. This vulnerability does not affect confidentiality or integrity but impacts availability by exhausting CPU resources. It requires that the backend returns JSON responses and that the WAF is configured to inspect response bodies. There are no known exploits in the wild.

A patch is available for this vulnerability. Users should upgrade to a fixed version of Coraza v3 that enforces recursion limits on JSON response body processing. Until patched, disabling ResponseBodyAccess or avoiding inspection of JSON response bodies can mitigate the risk. The vendor advisory confirms a fix is available; apply the official update.