corazawaf vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20251
3. 202612

Newest CVEs

• CVE-2026-114101

  Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

  corazawaf · coraza

  Medium6.3
• CVE-2026-114100

  Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

  corazawaf · coraza

  Medium6.9
• CVE-2026-114099

  Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

  corazawaf · coraza

  Medium6.9
• CVE-2026-41508

  OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

  corazawaf · coraza

  Medium5.8
• CVE-2026-41504

  OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields

  corazawaf · coraza

  Medium5.8
• CVE-2026-104774

  OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

  corazawaf · coraza

  Medium5.8
• CVE-2026-41510

  OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

  corazawaf · coraza

  High7.2
• CVE-2026-107835

  OWASP Coraza WAF: Cookie Parser Confusion

  corazawaf · coraza

  Medium4.0
• CVE-2026-107834

  OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

  corazawaf · coraza

  Medium5.3
• CVE-2026-107833

  OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

  corazawaf · coraza

  Medium5.9