Live › vulnerability › CVE-2026-114100
Go to dashboardCoraza, a Go web application firewall library, only parses request bodies whose Content-Type matches exactly, so adding a charset parameter skips body rules. An unauthenticated attacker can send form data with a charset suffix so WAF body rules miss the payload while the backend still processes it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Coraza-based WAF rules to inspect form POST bodies, typically through a Caddy, Traefik or Go proxy integration. Deployments that do not use Coraza for body inspection, or that use only other WAFs, can skip it. Whether a given deployment is exposed depends on the sources, which do not name specific downstream products.
No product ranges from the sources yet.
go list -m github.com/corazawaf/coraza/v3) and whether it is between 3.0.4 and 3.8.13.8.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.
This page as .md · .json · in your agent: get_signal("CVE-2026-114100")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.