CVE-2026-114100 json
Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type
published 2026-10-08 31 d ago modified 2026-10-22 17 d ago also EUVD-2026-106903 , GHSA-w253-m66g-rx24 , GO-2026-6698
- cvss
- 5.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.
Patch / fix
- go github.com/corazawaf/coraza/v3 3.8.1
- corazawaf coraza 3.8.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 d ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
| CNA | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| GitHub | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/corazawaf/coraza/v3 | >=3.0.4, <3.8.1 |
3.8.1 |
| go | github.com/corazawaf/coraza | all versions |
no fix listed |
| go | github.com/corazawaf/coraza/v2 | all versions |
no fix listed |
Affected products
- corazawaf coraza
Classification
References
-
github.com
/corazawaf/coraza/commit/3b6241ef895b089c66a59e51068a81cf40986e4d
web, patch
-
github.com
/corazawaf/coraza/commit/a55950ffa161f33a29e14f87d926d7df3b85cc74
web, patch
-
github.com
/corazawaf/coraza/commit/dd100261cf1d2e2b053803a50c9db28dcaaa4b7c
web, patch
-
github.com
/corazawaf/coraza/security/advisories/GHSA-w253-m66g-rx24
vendor-advisory, web, advisory
-
vulncheck.com
/advisories/coraza-from-3.0.4-before-3.8.1-request-body-inspection-bypass-via-content-type
third-party-advisory
-
github.com
/corazawaf/coraza
package
-
github.com
/corazawaf/coraza/releases/tag/v3.8.1
web
Sources
- CVE List CVE-2026-114100
- GitHub Advisory GHSA-w253-m66g-rx24
- NVD CVE-2026-114100
- OSV GO-2026-6698
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.