CVE-2026-107833 · GHSA-3c6w-j9xm-8h2h

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Risk score: 47/100
CVSS: 5.9 v3.1
Exploit chance (30 days): 0.4%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application pro…
Affected: github.com/corazawaf/coraza/v3 (go) >= 3.0.0, < 3.8.0
Fix: Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/corazawaf/coraza/v3: Amber, patch this week. OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when …

The flaws

CVE-2026-107833: Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion (CVSS 5.9 · EPSS 0%)
CVE-2026-41510: Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding (CVSS 7.2 · EPSS 0%)
CVE-2026-107826: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) (CVSS 7.5 · EPSS 0%)
CVE-2026-41508: Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling (CVSS 5.8 · EPSS 0%)

The fix

Upgrade github.com/corazawaf/coraza/v3: 3.8.0 · 3.8.1 or later on your release line

Who is exposed: github.com/corazawaf/coraza/v3 (go) >= 3.0.0, < 3.8.1

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-674 (CWE-674). 55 other warnings in 30 days

Why it is Yellow

CVSS 5.9 medium
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/corazawaf/coraza/v3	go	>= 3.0.0, < 3.8.0	3.8.0

References

Original description

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.