Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-114099

Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

corazawaf coraza

Default version status: unaffected

  • 3.0.0 to < 3.8.1affected
  • 3.8.1unaffected
pkg:golang/github.com/corazawaf/coraza/v3

References