Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: corazawaf coraza 3.8.1 Clear all filters
TI-2026-78714 CVE-2026-114101

Multipart filename* charset handling bypasses Coraza FILES rules

Priority MEDIUM 61

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00251 Published 2026-10-21 Fixed in 3.8.1 CWE-20
TI-2026-78713 CVE-2026-114100

Request body inspection bypass in Coraza via Content-Type parameters

Priority LOW 36

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-t…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00282 Published 2026-10-21 Fixed in 3.8.1 CWE-20
TI-2026-78712 CVE-2026-114099

Coraza JSON key collision lets SQL injection evade WAF rules

Priority MEDIUM 64

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00293 Published 2026-10-21 Fixed in 3.8.1 CWE-20