Skip to content
OpenAdvisories

Package · Go

github.com/corazawaf/coraza

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.2
    CVE-2026-41510

    OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS…

    corazawaf coraza github.com/corazawaf/coraza/v2 github.com/corazawaf/coraza/v3 Go
  • High 7.5
    CVE-2026-107826

    OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gj…

    corazawaf coraza github.com/corazawaf/coraza/v3 github.com/corazawaf/coraza/v2 Go