CVE-2026-114099Medium· 5.8▾ SunlitCoraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted p…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.
coraza >= 3.0.0 < 3.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114101Medium· 4.0Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
CVE-2026-114100Medium· 5.8Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type
GHSA-5gj4-9gm7-2fx2Medium· 5.8Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection
CVE-2026-107825Medium· 4.0OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-41508Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
GHSA-x26q-wvhg-fh4mMedium· 4.0Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations