{"id":"CVE-2026-114100","kind":"vulnerability","aliases":["CVE-2026-114100"],"related":[],"title":"Coraza WAF: URL-encoded bodies with charset parameter skip inspection","description":"Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.","summary":"Coraza, a Go web application firewall library, only parses request bodies whose Content-Type matches exactly, so adding a charset parameter skips body rules. An unauthenticated attacker can send form data with a charset suffix so WAF body rules miss the payload while the backend still processes it.","severity":"medium","cvss":6.9,"epss":0.00225,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coraza","go","package","self-hosted","waf"],"not_affected_if":["body-inspection-off","no-coraza"],"how_to_check":"- Check the Coraza version in go.mod (`go list -m github.com/corazawaf/coraza/v3`) and whether it is between `3.0.4` and `3.8.1`\n- Check whether the WAF runs in front of the app with body inspection enabled","fix":"- Upgrade Coraza to `3.8.1` or later\n- Until upgraded, unknown whether a configuration workaround exists","status":"open","published_at":"2026-10-21T01:17:35+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:40:13+00:00","updated_at":"2026-10-25T03:40:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:40:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coraza to `3.8.1` or later\n- Until upgraded, unknown whether a configuration workaround exists","reach":"internet","title":"Coraza WAF: URL-encoded bodies with charset parameter skip inspection","impact":"medium","summary":"Coraza, a Go web application firewall library, only parses request bodies whose Content-Type matches exactly, so adding a charset parameter skips body rules. An unauthenticated attacker can send form data with a charset suffix so WAF body rules miss the payload while the backend still processes it.","category":"package","nicknames":[],"who_cares":["coraza","waf","go","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacks in form bodies bypass WAF rules and reach the backend","analyst_note":"Confirm the affected downstream integrations and any workaround at https://nvd.nist.gov/vuln/detail/CVE-2026-114100.","how_to_check":"- Check the Coraza version in go.mod (`go list -m github.com/corazawaf/coraza/v3`) and whether it is between `3.0.4` and `3.8.1`\n- Check whether the WAF runs in front of the app with body inspection enabled","needs_analyst":true,"not_affected_if":["no-coraza","body-inspection-off"],"who_is_affected":"Teams running Coraza-based WAF rules to inspect form POST bodies, typically through a Caddy, Traefik or Go proxy integration. Deployments that do not use Coraza for body inspection, or that use only other WAFs, can skip it. Whether a given deployment is exposed depends on the sources, which do not name specific downstream products.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":3420,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114100':14A,17A '-2026':13A,16A '-8':123C '3.0.4':75C '3.8.1':77C 'add':43B 'applic':29B 'application/x-www-form-urlencoded':120C 'arg':126C 'attack':52B,117C 'backend':70B,137C 'bodi':6A,35B,48B,63B,81C,87C,102C,130C,133C 'bypass':83C 'carri':107C 'charset':8A,45B,59B,121C 'compar':90C 'contain':78C 'content':38B,94C,105C 'content-typ':37B,93C,104C 'coraza':1A,18B,25B,73C 'cve':12A,15A 'data':56B 'empti':131C 'encod':5A,101C 'entir':92C 'evad':132C 'exact':41B,97C 'firewal':30B 'form':55B 'go':19B,27B 'host':23B 'inspect':11A,82C 'keep':125C 'librari':31B 'match':40B 'media':110C 'media-typ':109C 'miss':65B 'never':114C 'packag':20B 'paramet':9A,46B,112C 'pars':33B,115C 'payload':67B,141C 'post':127C 'process':72B,139C 'processor':88C 'request':34B,80C,86C,129C 'request-bodi':85C 'rule':49B,64B,134C 'select':89C 'self':22B 'self-host':21B 'send':54B,119C 'skip':10A,47B 'still':71B,138C 'suffix':60B 'type':39B,95C,106C,111C 'unauthent':51B,116C 'url':4A,100C 'url-encod':3A,99C 'utf':122C 'valu':96C 'waf':2A,24B,62B 'web':28B 'whose':36B,103C","nicknames":[],"mitigations":[],"who_affected":"Teams running Coraza-based WAF rules to inspect form POST bodies, typically through a Caddy, Traefik or Go proxy integration. Deployments that do not use Coraza for body inspection, or that use only other WAFs, can skip it. Whether a given deployment is exposed depends on the sources, which do not name specific downstream products.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114100","severity":null,"published_at":"2026-10-21T01:17:35+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114100","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114100","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}