Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114099Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Medium 5.8

In plain English

A medium-severity improper input validation in coraza from corazawaf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/corazawaf/coraza	no fix listed	GO-2026-6692
Go	github.com/corazawaf/coraza/v2	no fix listed	GO-2026-6692
Go	github.com/corazawaf/coraza/v3	3.8.1	GHSA-5gj4-9gm7-2fx2
Go	github.com/corazawaf/coraza/v3	3.8.1	GO-2026-6692

Affected products (as reported)

Vendor	Product	Versions
corazawaf	coraza	3.0.0 – before 3.8.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-5gj4-9gm7-2fx2) vendor-advisory
VulnCheck Advisory: Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision third-party-advisory