CVE-2026-107825mediumCWE-20CWE-436

CVE-2026-107825: falha de média gravidade em corazawaf coraza

OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar coraza+ Monitorar github.com/corazawaf/coraza/v2

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4epss 0.3%
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. The bundled coraza/v3/http integration is not affected because Go net/http rejects such malformed request targets before calling Coraza. This issue is fixed in version 3.8.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Produtos afetados
corazawaf · coraza
CVEs relacionadas — corazawaf coraza

No mesmo produto, das mais perigosas para as menos.

CVE-2023-40586HIGHgo package github.com/corazawaf/coraza is vulnerable to denial of serviceEPSS 0.7%CVE-2026-41508MEDIUMOWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingEPSS 0.5%CVE-2026-107826HIGHOWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)EPSS 0.5%CVE-2026-107833MEDIUMOWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustionEPSS 0.4%CVE-2026-41510HIGHOWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingEPSS 0.4%CVE-2026-41504MEDIUMOWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsEPSS 0.4%