Skip to content
OpenAdvisories

Package · Go

github.com/corazawaf/coraza/v2

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.0
    CVE-2026-114101 Public exploit

    Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

    Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''…

    corazawaf coraza github.com/corazawaf/coraza/v2 github.com/corazawaf/coraza/v3 Go