{"id":"CVE-2026-114099","kind":"vulnerability","aliases":["CVE-2026-114099"],"related":[],"title":"Coraza WAF: JSON body flattening lets crafted keys hide SQL injection","description":"Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.","summary":"Coraza, a Go web application firewall, flattens nested JSON request bodies into dot-separated argument names without escaping literal dots, so different properties collide. An unauthenticated attacker can send a later dotted key such as account.role that overwrites a malicious nested value, so OWASP CRS rules miss SQL injection payloads that the backend still receives.","severity":"medium","cvss":6.9,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coraza","go","owasp-crs","package","self-hosted","waf"],"not_affected_if":["default-config","non-json-bodies","other-waf"],"how_to_check":"- Check the Coraza version in `go.mod` or the vendored module: affected if it is from `3.0.0` up to but not including `3.8.1`.\n- Check whether the Coraza JSON body processor is enabled with CRS rules protecting endpoints that accept JSON request bodies.","fix":"- Upgrade Coraza to `3.8.1` or later.\n- Until upgraded, unknown whether a configuration workaround exists; the sources do not say.","status":"open","published_at":"2026-10-21T01:17:35+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:40:12+00:00","updated_at":"2026-10-25T03:40:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:40:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coraza to `3.8.1` or later.\n- Until upgraded, unknown whether a configuration workaround exists; the sources do not say.","reach":"internet","title":"Coraza WAF: JSON body flattening lets crafted keys hide SQL injection","impact":"medium","summary":"Coraza, a Go web application firewall, flattens nested JSON request bodies into dot-separated argument names without escaping literal dots, so different properties collide. An unauthenticated attacker can send a later dotted key such as account.role that overwrites a malicious nested value, so OWASP CRS rules miss SQL injection payloads that the backend still receives.","category":"package","nicknames":[],"who_cares":["coraza","waf","go","owasp-crs","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"SQL injection payloads pass the WAF and reach the backend unfiltered","analyst_note":"","how_to_check":"- Check the Coraza version in `go.mod` or the vendored module: affected if it is from `3.0.0` up to but not including `3.8.1`.\n- Check whether the Coraza JSON body processor is enabled with CRS rules protecting endpoints that accept JSON request bodies.","needs_analyst":false,"not_affected_if":["default-config","non-json-bodies","other-waf"],"who_is_affected":"Teams running Coraza 3.0.0 through 3.8.0 as a WAF in front of applications that accept JSON request bodies and rely on OWASP CRS rules for SQL injection protection. Deployments that do not use Coraza's JSON body processor, or that run other WAF engines, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000646,"input_tokens":3396,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114099':14A,17A '-2026':13A,16A '3.0.0':86C '3.8.1':88C 'account.role':64B,123C 'add':116C 'applic':32B 'arg':102C 'argument':43B 'attack':55B,114C 'backend':81B,139C 'bodi':4A,38B,92C 'collid':52B,112C 'coraza':1A,18B,28B,84C 'craft':7A 'crs':22B,73B,136C 'cve':12A,15A 'differ':50B 'distinct':110C 'dot':41B,48B,60B,100C,108C,119C 'dot-separ':40B,99C 'escap':46B,106C 'firewal':33B 'flatten':5A,34B,95C 'go':19B,30B 'hide':9A,130C 'host':26B 'inject':11A,77B,132C 'json':3A,36B,91C 'key':8A,61B 'later':59B,118C 'let':6A 'liter':47B,107C 'malici':68B,127C 'miss':75B 'name':44B,104C 'nest':35B,69B,96C,128C 'overwrit':66B,125C 'owasp':21B,72B,135C 'owasp-cr':20B 'packag':23B 'payload':78B,133C 'post':103C 'processor':93C 'properti':51B,97C,111C,120C 'receiv':83B,141C 'request':37B 'rule':74B,137C 'self':25B 'self-host':24B 'send':57B 'separ':42B,101C 'sql':10A,76B,131C 'still':82B,140C 'unauthent':54B,113C 'valu':70B,129C 'waf':2A,27B 'web':31B 'without':45B,105C","nicknames":[],"mitigations":[],"who_affected":"Teams running Coraza 3.0.0 through 3.8.0 as a WAF in front of applications that accept JSON request bodies and rely on OWASP CRS rules for SQL injection protection. Deployments that do not use Coraza's JSON body processor, or that run other WAF engines, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114099","severity":null,"published_at":"2026-10-21T01:17:35+00:00","modified_at":"2026-10-22T17:34:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114099","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114099","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}