TI-2026-71268 Aliases CVE-2026-104774

Off-by-one error in OWASP Coraza jsDecode enables WAF rule bypass

HIGH 65CWE-172Published 2026-10-12 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-693.

Summary

OWASP Coraza WAF from 3.0.0 before 3.8.0 and the Go module github.com/corazawaf/coraza/v3 from 3.0.0 before 3.8.0 are affected. The t:jsDecode transformation includes the backslash in its octal buffer, so parsing an octal escape yields a null byte instead of the intended character (CWE-193). An unauthenticated remote attacker can encode attack strings with JavaScript octal escapes so that rules using t:jsDecode inspect corrupted output and miss the attack, such as cross-site scripting or SQL injection.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00322 25th percentileScored 2026-11-07

Fix Fixed coraza (corazawaf): 3.8.0github.com/corazawaf/coraza/v3 (Go): 3.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
corazawaf	coraza	3.0.0 to before 3.8.0	3.8.0	Patch available	CNA
—	github.com/corazawaf/coraza/v3 (Go)	3.0.0 to before 3.8.0	3.8.0	Patch available	GHSA-pc5q-qfxp-ggqv

coraza Vendorcorazawaf Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available CNA
github.com/corazawaf/coraza/v3 (Go) Vendor— Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available GHSA-pc5q-qfxp-ggqv

Remediation

The Go module github.com/corazawaf/coraza/v3 is fixed in version 3.8.0. The sources list no fixed version for coraza.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA coraza (corazawaf) Fixed in 3.8.0
Fix · GHSA-pc5q-qfxp-ggqv github.com/corazawaf/coraza/v3 (Go) Fixed in 3.8.0 Advisory →

Timeline

2026-10-12 Threatist record created from CVE-2026-104774
2026-10-13 CISA SSVC decision points changed
2026-10-13 Priority changed: MEDIUM → HIGH

References

Other 4

TI-2026-69592 Uncontrolled recursion in Coraza WAF JSON parsing crashes the process CVSS 3.1HIGH 7.5
TI-2026-71270 Coraza WAF silently drops arguments at ArgumentLimit, enabling rule bypass CVSS 3.1HIGH 7.2
TI-2026-78712 Coraza JSON key collision lets SQL injection evade WAF rules CVSS 4.0MEDIUM 6.9
TI-2026-78714 Multipart filename* charset handling bypasses Coraza FILES rules CVSS 4.0MEDIUM 6.3
TI-2026-69596 Uncontrolled recursion in Coraza WAF JSON processing exhausts CPU CVSS 3.1MEDIUM 5.9
TI-2026-71308 CRLF injection in OWASP Coraza WAF native audit log lets attackers forge lines CVSS 3.1MEDIUM 5.8

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences