CVE-2026-107826highCWE-674

CVE-2026-107826: high-severity vulnerability in corazawaf coraza

OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

Published

Follow this CVE+ Monitor coraza+ Monitor github.com/corazawaf/coraza/v2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.5%
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
corazawaf · coraza
Related CVEs — corazawaf coraza

In the same product, most dangerous first.

CVE-2023-40586HIGHgo package github.com/corazawaf/coraza is vulnerable to denial of serviceEPSS 0.7%CVE-2026-41508MEDIUMOWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingEPSS 0.5%CVE-2026-107833MEDIUMOWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustionEPSS 0.4%CVE-2026-41510HIGHOWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingEPSS 0.4%CVE-2026-41504MEDIUMOWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsEPSS 0.4%CVE-2026-104774MEDIUMOWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF BypassEPSS 0.3%