Read the docs

corazawaf

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

corazawaf records in CISA KEV

No corazawaf vulnerabilities are listed in CISA KEV.

Records

13 records

TI-2026-78712 CVE-2026-114099

Coraza JSON key collision lets SQL injection evade WAF rules

Priority MEDIUM 64

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00293 Published 2026-10-21 Fixed in 3.8.1 CWE-20
TI-2026-78714 CVE-2026-114101

Multipart filename* charset handling bypasses Coraza FILES rules

Priority MEDIUM 61

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00251 Published 2026-10-21 Fixed in 3.8.1 CWE-20
TI-2026-78713 CVE-2026-114100

Request body inspection bypass in Coraza via Content-Type parameters

Priority LOW 36

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-t…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00282 Published 2026-10-21 Fixed in 3.8.1 CWE-20
Open these records in search →