Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-114100

Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

corazawaf coraza

Default version status: unaffected

  • 3.0.4 to < 3.8.1affected
  • 3.8.1unaffected
pkg:golang/github.com/corazawaf/coraza/v3

References