CRLF injection in OWASP Coraza WAF native audit log lets attackers forge lines
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
OWASP Coraza WAF from 3.0.0 before 3.8.0 writes request and response fields into its Native audit log format without neutralizing carriage returns or line feeds when SecAuditLogFormat Native is enabled (CWE-93). A remote, unauthenticated attacker who controls request or response body, header, error-message, or matched-rule data can inject line breaks that appear as forged lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, though the unpredictable transaction boundary prevents straightforward impersonation of a separate session.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| corazawaf | coraza | 3.0.0 to before 3.8.0 | 3.8.0 | Patch available | CNA |
| — | github.com/corazawaf/coraza/v3 (Go) | 3.0.0 to before 3.8.0 | 3.8.0 | Patch available | GHSA-prpw-wwv7-xjjr |
- coraza Vendorcorazawaf Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available CNA
- github.com/corazawaf/coraza/v3 (Go) Vendor— Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available GHSA-prpw-wwv7-xjjr
Remediation
Upgrade the github.com/corazawaf/coraza/v3 Go module to version 3.8.0, which fixes this issue. The sources list no fixed version for coraza.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA coraza (corazawaf) Fixed in 3.8.0
- Fix · GHSA-prpw-wwv7-xjjr github.com/corazawaf/coraza/v3 (Go) Fixed in 3.8.0 Advisory →
Timeline
- 2026-10-12 Threatist record created from CVE-2026-41504
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: LOW → MEDIUM
References
More corazawaf vulnerabilities
- TI-2026-69592 Uncontrolled recursion in Coraza WAF JSON parsing crashes the process CVSS 3.1HIGH 7.5
- TI-2026-71270 Coraza WAF silently drops arguments at ArgumentLimit, enabling rule bypass CVSS 3.1HIGH 7.2
- TI-2026-71268 Off-by-one error in OWASP Coraza jsDecode enables WAF rule bypass CVSS 3.1MEDIUM 5.8
- TI-2026-78712 Coraza JSON key collision lets SQL injection evade WAF rules CVSS 4.0MEDIUM 6.9
- TI-2026-78714 Multipart filename* charset handling bypasses Coraza FILES rules CVSS 4.0MEDIUM 6.3
- TI-2026-69596 Uncontrolled recursion in Coraza WAF JSON processing exhausts CPU CVSS 3.1MEDIUM 5.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences