Read the docs
TI-2026-78712 Aliases CVE-2026-114099

Coraza JSON key collision lets SQL injection evade WAF rules

Priority MEDIUM 64CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide (CWE-20). An unauthenticated remote attacker can add a later dotted property that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while the backend still receives them.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00293 22nd percentileScored 2026-11-07
Fix Fixed coraza (corazawaf): 3.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
corazawafcoraza3.0.0 to before 3.8.13.8.1Patch availableCNA
  • coraza Vendorcorazawaf Affected 3.0.0 to before 3.8.1 Fixed in 3.8.1 Patch available CNA

Remediation

Upgrade Coraza to version 3.8.1, which fixes the issue. Versions from 3.0.0 before 3.8.1 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA coraza (corazawaf) Fixed in 3.8.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    corazawaf coraza 3.8.1

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-78714 Multipart filename* charset handling bypasses Coraza FILES rulesPriority MEDIUM 61
    • TI-2026-78713 Request body inspection bypass in Coraza via Content-Type parametersPriority LOW 36
    Show all 3 records →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114099
  2. 2026-10-22 Priority changed: MEDIUM → LOW
  3. 2026-10-28 CISA SSVC decision points changed
  4. 2026-10-28 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2026-69592 Uncontrolled recursion in Coraza WAF JSON parsing crashes the process CVSS 3.1HIGH 7.5
  • TI-2026-71270 Coraza WAF silently drops arguments at ArgumentLimit, enabling rule bypass CVSS 3.1HIGH 7.2
  • TI-2026-71268 Off-by-one error in OWASP Coraza jsDecode enables WAF rule bypass CVSS 3.1MEDIUM 5.8
  • TI-2026-78714 Multipart filename* charset handling bypasses Coraza FILES rules CVSS 4.0MEDIUM 6.3
  • TI-2026-69596 Uncontrolled recursion in Coraza WAF JSON processing exhausts CPU CVSS 3.1MEDIUM 5.9
  • TI-2026-71308 CRLF injection in OWASP Coraza WAF native audit log lets attackers forge lines CVSS 3.1MEDIUM 5.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences