Log in Start free

Vulnerability · Published Oct 9, 2026 · Assigned by GitHub_M

CVE-2026-107835OWASP Coraza WAF: Cookie Parser Confusion

Medium 4.0

In plain English

A medium-severity security flaw in coraza from corazawaf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.3%top 77.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. Exploitation depends on the backend parser and affected rule scope, and interior control characters with inconsistent backend behavior are outside this advisory's remediation. This issue is fixed in version 3.8.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/corazawaf/corazano fix listedGO-2026-6694
Gogithub.com/corazawaf/coraza/v2no fix listedGO-2026-6694
Gogithub.com/corazawaf/coraza/v33.8.1GHSA-g4qm-m288-5cp9
Gogithub.com/corazawaf/coraza/v33.8.1GO-2026-6694

Affected products (as reported)

VendorProductVersions
corazawaf coraza < 3.8.1

Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References