github.com/corazawaf/coraza/v2
Go5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/corazawaf/coraza/v2page 1 of 1
- CVE-2023-40586HIGHCVSS 7.5EG 7.52023-08-25
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately…
- CVE-2025-29914MEDIUMCVSS 5.4EG 5.42025-03-20
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUEST_FILENAME. For example, if the URI //bar/uploads…
- CVE-2026-114099MEDIUMCVSS 5.8EG 5.82026-10-21
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted pro…
- CVE-2026-114100MEDIUMCVSS 5.8EG 5.82026-10-21
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are n…
- CVE-2026-114101MEDIUMCVSS 4.0EG 4.02026-10-21
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with fi…
Check whether github.com/corazawaf/coraza/v2 is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/corazawaf/coraza/v2 CVEs against the assets you own.
Book a Demo →