CVE-2026-114100Medium· 5.8▾ SunlitCoraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.
coraza >= 3.0.4 < 3.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114099Medium· 5.8Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision
CVE-2026-114101Medium· 4.0Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
GHSA-w253-m66g-rx24Medium· 5.8Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection
CVE-2026-107825Medium· 4.0OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
CVE-2026-41508Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
GHSA-5gj4-9gm7-2fx2Medium· 5.8Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection