CO
Product
coraza
13
CVEs
0
On KEV
7.5
Max CVSS
12
New 30D
Severity mix
Critical 0High 2Medium 11Low 0
Watch
Add coraza to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107826 | 7.5 | Oct 9 | OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) Affected: >= 3.0.0, < 3.8.1 |
| CVE-2026-41510 | 7.2 | Oct 12 | OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding Affected: >= 3.0.0, < 3.8.1 |
| CVE-2026-107833 | 5.9 | Oct 9 | OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion Affected: >= 3.0.0, < 3.8.0 |
| CVE-2026-114100 | 5.8 | Oct 21 | Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type Affected: 3.0.4 before 3.8.1 |
| CVE-2026-114099 | 5.8 | Oct 21 | Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision Affected: 3.0.0 before 3.8.1 |
| CVE-2026-41508 | 5.8 | Oct 12 | OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling Affected: >= 3.4.0, < 3.8.0 |
| CVE-2026-41504 | 5.8 | Oct 12 | OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields Affected: >= 3.0.0, < 3.8.0 |
| CVE-2026-104774 | 5.8 | Oct 12 | OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass Affected: >= 3.0.0, < 3.8.0 |
| CVE-2025-29914 | 5.4 | Mar 20 | OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` Affected: < 3.3.3 |
| CVE-2026-107834 | 5.3 | Oct 9 | OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor Affected: >= 3.0.0, < 3.8.0 |
| CVE-2026-114101 | 4.0 | Oct 21 | Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass Affected: before 3.8.1 |
| CVE-2026-107835 | 4.0 | Oct 9 | OWASP Coraza WAF: Cookie Parser Confusion Affected: < 3.8.1 |
| CVE-2026-107825 | 4.0 | Oct 9 | OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations Affected: >= 3.0.0, < 3.8.0 |
Showing 13