Live › vulnerability › CVE-2026-114099
Go to dashboardCoraza, a Go web application firewall, flattens nested JSON request bodies into dot-separated argument names without escaping literal dots, so different properties collide. An unauthenticated attacker can send a later dotted key such as account.role that overwrites a malicious nested value, so OWASP CRS rules miss SQL injection payloads that the backend still receives.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Coraza 3.0.0 through 3.8.0 as a WAF in front of applications that accept JSON request bodies and rely on OWASP CRS rules for SQL injection protection. Deployments that do not use Coraza's JSON body processor, or that run other WAF engines, are not affected.
No product ranges from the sources yet.
go.mod or the vendored module: affected if it is from 3.0.0 up to but not including 3.8.1.3.8.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.
This page as .md · .json · in your agent: get_signal("CVE-2026-114099")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.