go package github.com/corazawaf/coraza is vulnerable to denial of service
Priority HIGH 72CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00723 54th percentileScored 2026-11-07
Fix Fixed coraza (corazawaf): 3.0.1github.com/corazawaf/coraza/v3 (Go): 3.0.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| corazawaf | coraza | before 3.0.1 | 3.0.1 | Patch available | CNA |
| — | github.com/corazawaf/coraza/v3 (Go) | 3.0.0 to before 3.0.1 | 3.0.1 | Patch available | GHSA-c2pj-v37r-2p6h |
| — | github.com/corazawaf/coraza/v2 (Go) | 2.0.0 – 2.0.1 | — | No fix listed | GHSA-c2pj-v37r-2p6h |
- coraza Vendorcorazawaf Affected before 3.0.1 Fixed in 3.0.1 Patch available CNA
- github.com/corazawaf/coraza/v3 (Go) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-c2pj-v37r-2p6h
- github.com/corazawaf/coraza/v2 (Go) Vendor— Affected 2.0.0 – 2.0.1 Fixed in — No fix listed GHSA-c2pj-v37r-2p6h
Remediation
- Fix · CNA coraza (corazawaf) Fixed in 3.0.1
- Fix · GHSA-c2pj-v37r-2p6h github.com/corazawaf/coraza/v3 (Go) Fixed in 3.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40586
- 2026-10-03 Alias added: GHSA-c2pj-v37r-2p6h
References
Advisory 2
Other 7
- https://github.com/corazawaf/coraza-caddy/issues/48
- https://github.com/corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec
- https://github.com/corazawaf/coraza/commit/e1b119b83e12c64f0957e00e8cad45a1b5f012f8
- https://github.com/corazawaf/coraza
- https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.go#L26-L29
- https://github.com/corazawaf/coraza/releases/tag/v3.0.1
- https://github.com/golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291
More corazawaf vulnerabilities
- TI-2026-69592 Uncontrolled recursion in Coraza WAF JSON parsing crashes the process CVSS 3.1HIGH 7.5
- TI-2026-71270 Coraza WAF silently drops arguments at ArgumentLimit, enabling rule bypass CVSS 3.1HIGH 7.2
- TI-2026-71268 Off-by-one error in OWASP Coraza jsDecode enables WAF rule bypass CVSS 3.1MEDIUM 5.8
- TI-2026-78712 Coraza JSON key collision lets SQL injection evade WAF rules CVSS 4.0MEDIUM 6.9
- TI-2026-78714 Multipart filename* charset handling bypasses Coraza FILES rules CVSS 4.0MEDIUM 6.3
- TI-2026-69596 Uncontrolled recursion in Coraza WAF JSON processing exhausts CPU CVSS 3.1MEDIUM 5.9
Sources
- CVE-2023-40586 · CVE Program
- CVE-2023-40586 · NVD
- FIRST EPSS
- GHSA-c2pj-v37r-2p6h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences