Description
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| corazawaf | coraza | 3.0.4 – < 3.8.1 | 3.8.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/corazawaf/coraza | all versions | — | GO-2026-6698 |
| Go | github.com/corazawaf/coraza/v2 | all versions | — | GO-2026-6698 |
| Go | github.com/corazawaf/coraza/v3 | >= 3.0.4, < 3.8.1 | 3.8.1 | GHSA-w253-m66g-rx24 |
References
- GitHub Security Advisory (GHSA-w253-m66g-rx24) vendor-advisory
- VulnCheck Advisory: Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type third-party-advisory