github.com/corazawaf/coraza/v3 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-107834Mediumgithub.com/corazawaf/coraza/v3: Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processorGHSA-W253-M66G-RX24Mediumgithub.com/corazawaf/coraza/v3: Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspectionCVE-2026-107833Mediumgithub.com/corazawaf/coraza/v3: Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustionGHSA-3WR7-993Q-JRFFMediumgithub.com/corazawaf/coraza/v3: Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rulesGHSA-G4QM-M288-5CP9Mediumgithub.com/corazawaf/coraza/v3: Coraza has Cookie Parser ConfusionCVE-2026-107825Mediumgithub.com/corazawaf/coraza/v3: Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationsCVE-2026-104774Mediumgithub.com/corazawaf/coraza/v3: Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF BypassCVE-2026-107826Highgithub.com/corazawaf/coraza/v3: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)GHSA-5GJ4-9GM7-2FX2Mediumgithub.com/corazawaf/coraza/v3: Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspectionCVE-2026-41510Highgithub.com/corazawaf/coraza/v3: Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingCVE-2026-41508Mediumgithub.com/corazawaf/coraza/v3: Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingCVE-2026-41504Mediumgithub.com/corazawaf/coraza/v3: Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsCVE-2025-29914Mediumgithub.com/jptosso/coraza-waf: OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`CVE-2023-40586Highgithub.com/corazawaf/coraza/v3: Coraza has potential denial of service vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo