CVE-2026-107835
mediumOWASP Coraza WAF is a golang modsecurity compatible web application firewall library.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. Exploitation depends on the backend parser and affected rule scope, and interior control characters with inconsistent backend behavior are outside this advisory's remediation. This issue is fixed in version 3.8.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/corazawaf/coraza/commit/0b940e197ad9983fb3aa36e84f1f81ff985461af security-advisories@github.com
- https://github.com/corazawaf/coraza/commit/9f8521398d1ff023b958fad0b944cac265763866 security-advisories@github.com
- https://github.com/corazawaf/coraza/releases/tag/v3.8.1 security-advisories@github.com
- https://github.com/corazawaf/coraza/security/advisories/GHSA-g4qm-m288-5cp9 security-advisories@github.com
- https://github.com/corazawaf/coraza/security/advisories/GHSA-g4qm-m288-5cp9 134c704f-9b21-4f2e-91b3-4a467353bcc0