CVE-2026-114101 is a medium severity vulnerability in Coraza before version 3.8.1. It involves improper input validation during multipart upload filename extraction, where the software uses Go's mime.ParseMediaType which ignores RFC 5987 filename* parameters with charsets other than utf-8 or us-ascii. This allows unauthenticated attackers to craft filenames that bypass FILES-based security rules, potentially enabling dangerous uploads to reach backend systems that honor the filename* parameter.
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.
Coraza versions from 3.0.0 up to but not including 3.8.1 contain an improper input validation vulnerability in their JSON body processor. This processor flattens nested JSON properties into dot-separated ARGS_POST names without escaping literal dots, causing distinct properties to collide. An unauthenticated attacker can exploit this by adding a dotted property such as account.role that overwrites a nested value, potentially hiding SQL injection payloads from OWASP CRS rules while still delivering them to the backend.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. Exploitation depends on the backend parser and affected rule scope, and interior control characters with inconsistent backend behavior are outside this advisory's remediation. This issue is fixed in version 3.8.1.
CVE-2026-107834 is a medium severity vulnerability in OWASP Coraza WAF versions 3.0.0 through 3.7.x. It involves uncontrolled resource consumption due to the handling of multipart file uploads, where temporary file descriptors remain open until the entire request completes. An unauthenticated attacker can exploit this by submitting many minimal file parts, exhausting the process file descriptor table and causing failures in creating temporary files, blocking legitimate uploads and preventing the process from opening files or sockets. This issue is fixed in version 3.8.0.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.
CVE-2026-107825 is an improper input validation vulnerability in Coraza WAF versions 3.0.0 through 3.7.x. The ProcessURI function fails to properly handle malformed URIs containing control bytes, causing query parameters to be omitted from internal variables while downstream integrations may still process them. This discrepancy allows unauthenticated attackers to bypass security rules targeting query parameters. The issue is fixed in version 3.8.0.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.
A protection mechanism failure exists in OWASP Coraza WAF versions 3.0.0 through 3.8.0. The WAF silently drops arguments exceeding the SecArgumentsLimit during request processing, causing some arguments to be omitted from inspection. This omission can allow attackers to bypass WAF rules. Additionally, processing of urlencoded and JSON bodies can consume excessive memory, potentially degrading service. The issue is fixed in version 3.8.1.