Corazawaf vulnerabilities
We track 3 vulnerabilities in Corazawaf products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2026.
Latest Corazawaf vulnerabilities
- 7.2 High severity
coraza: Protection Mechanism Failure
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_
- 7.5 High severity
coraza: Uncontrolled Recursion
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjs
- 7.5 High severity
coraza: Uncontrolled Resource Consumption
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receivin