CVE-2026-107826 · GHSA-6gcq-wc29-5xf2
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
- Risk score
- 63/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attac…
- Affected
- github.com/corazawaf/coraza/v3 (go) >= 3.0.0, < 3.8.1
- Fix
- Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.
- Exploitation
- No known exploitation
Story map
At a glance
github.com/corazawaf/coraza/v3: Amber, patch this week. OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when …
The flaws
- CVE-2026-107826: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) (CVSS 7.5 · EPSS 0%)
- CVE-2026-41510: Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding (CVSS 7.2 · EPSS 0%)
- CVE-2026-41508: Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling (CVSS 5.8 · EPSS 0%)
- CVE-2026-41504: Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields (CVSS 5.8 · EPSS 0%)
The fix
Upgrade github.com/corazawaf/coraza/v3: 3.8.1 · 3.8.0 or later on your release line
Who is exposed: github.com/corazawaf/coraza/v3 (go) >= 3.0.0, < 3.8.1
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-674 (CWE-674). 57 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/corazawaf/coraza/v3 | go | >= 3.0.0, < 3.8.1 | 3.8.1 |
References
- https://github.com/advisories/GHSA-6gcq-wc29-5xf2
- https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2
- https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f
- https://github.com/corazawaf/coraza/releases/tag/v3.8.1
- https://github.com/advisories/GHSA-6gcq-wc29-5xf2
Original description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.
Last activity 8 Oct 2026. Patch Forecast updates every hour.