Log in Start free

corazawaf

Products

ProductCVEsExploitedLatest
coraza14–Oct 21, 2026

Exploited and recent CVEs

  • CVE-2026-114101 Medium 4.0 Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass 0.3%
  • CVE-2026-114100 Medium 5.8 Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type 0.3%
  • CVE-2026-114099 Medium 5.8 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision 0.3%
  • CVE-2026-41508 Medium 5.8 OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling 0.5%
  • CVE-2026-41504 Medium 5.8 OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields 0.4%
  • CVE-2026-104774 Medium 5.8 OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass 0.3%
  • CVE-2026-41510 High 7.2 OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding 0.4%
  • CVE-2026-107835 Medium 4.0 OWASP Coraza WAF: Cookie Parser Confusion 0.3%
  • CVE-2026-107834 Medium 5.3 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor 0.3%
  • CVE-2026-107833 Medium 5.9 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion 0.4%
  • CVE-2026-107826 High 7.5 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) 0.5%
  • CVE-2026-107825 Medium 4.0 OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations 0.3%
  • CVE-2025-29914 Medium 5.4 OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` 0.3%
  • CVE-2023-40586 High 7.5 go package github.com/corazawaf/coraza is vulnerable to denial of service 0.7%