Skip to content
OpenAdvisories

Package · Go

github.com/corazawaf/coraza/v2

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.2
    CVE-2026-41510

    OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS…

    corazawaf coraza github.com/corazawaf/coraza/v2 github.com/corazawaf/coraza/v3 Go
  • High 7.5
    CVE-2026-107826

    OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gj…

    corazawaf coraza github.com/corazawaf/coraza/v3 github.com/corazawaf/coraza/v2 Go
  • High 7.5
    CVE-2023-40586

    go package github.com/corazawaf/coraza is vulnerable to denial of service

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receivi…

    corazawaf coraza github.com/corazawaf/coraza/v2 github.com/corazawaf/coraza/v3 Go