Live › vulnerability › CVE-2026-41504
Go to dashboardCoraza's Go WAF library writes attacker-controlled request and response fields into its Native audit log without stripping CR/LF characters, so injected line breaks can create forged lines inside a transaction record. The result is log forgery that can mislead operators and line-based SIEM parsing, not direct code execution or session takeover.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/corazawaf/coraza | go | all versions | – |
| github.com/corazawaf/coraza/v2 | go | all versions | – |
| github.com/corazawaf/coraza/v3 | go | >= 3.0.0, < 3.8.0 | 3.8.0 |
Check go.mod for github.com/corazawaf/coraza/v3 at a version >= 3.0.0 and < 3.8.0 (go list -m github.com/corazawaf/coraza/v3)
Check whether SecAuditLogFormat Native is enabled in the WAF configuration
Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-41504")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.