Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114100Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

Medium 5.8

In plain English

A medium-severity improper input validation in coraza from corazawaf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/corazawaf/coraza	no fix listed	GO-2026-6698
Go	github.com/corazawaf/coraza/v2	no fix listed	GO-2026-6698
Go	github.com/corazawaf/coraza/v3	3.8.1	GHSA-w253-m66g-rx24
Go	github.com/corazawaf/coraza/v3	3.8.1	GO-2026-6698

Affected products (as reported)

Vendor	Product	Versions
corazawaf	coraza	3.0.4 – before 3.8.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-w253-m66g-rx24) vendor-advisory
VulnCheck Advisory: Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type third-party-advisory