{"id":"CVE-2026-41504","kind":"vulnerability","aliases":["CVE-2026-41504","GHSA-prpw-wwv7-xjjr","GO-2026-6669"],"related":[],"title":"Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza","description":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.","summary":"Coraza's Go WAF library writes attacker-controlled request and response fields into its Native audit log without stripping CR/LF characters, so injected line breaks can create forged lines inside a transaction record. The result is log forgery that can mislead operators and line-based SIEM parsing, not direct code execution or session takeover.","severity":"medium","cvss":5.8,"epss":0.00392,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.0"],"affected":">= 3.0.0, < 3.8.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","modsecurity","package","self-hosted","waf"],"not_affected_if":["audit-log-format-not-native","coraza-3.8.0-or-later","coraza-below-3.0.0"],"how_to_check":"Check go.mod for github.com/corazawaf/coraza/v3 at a version >= 3.0.0 and < 3.8.0 (go list -m github.com/corazawaf/coraza/v3)\nCheck whether SecAuditLogFormat Native is enabled in the WAF configuration","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later","status":"open","published_at":"2026-10-12T21:17:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:58:07+00:00","updated_at":"2026-10-23T19:58:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:58:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later\nunknown whether a configuration workaround exists","summary":"Coraza's Go WAF library writes attacker-controlled request and response fields into its Native audit log without stripping CR/LF characters, so injected line breaks can create forged lines inside a transaction record. The result is log forgery that can mislead operators and line-based SIEM parsing, not direct code execution or session takeover.","category":"package","who_cares":["go","coraza","waf","self-hosted","modsecurity"],"confidence":0.7,"analyst_note":"Confirm whether the unversioned github.com/corazawaf/coraza and /v2 paths are affected (govuln lists fixed as '?'), see https://pkg.go.dev/vuln/GO-2026-6669 and https://nvd.nist.gov/vuln/detail/CVE-2026-41504.","how_to_check":"Check go.mod for github.com/corazawaf/coraza/v3 at a version >= 3.0.0 and < 3.8.0 (go list -m github.com/corazawaf/coraza/v3)\nCheck whether SecAuditLogFormat Native is enabled in the WAF configuration\nunknown for the unversioned github.com/corazawaf/coraza and /v2 module paths: affected range not stated in sources","needs_analyst":true,"not_affected_if":["coraza-below-3.0.0","coraza-3.8.0-or-later","audit-log-format-not-native"],"severity_if_unknown":"medium"},"cost_usd":0.000507,"input_tokens":2389,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':24A,32A,35A '-41504':25A,36A '-6669':33A '/corazawaf/coraza':22A,39A '/corazawaf/coraza/v2':42A '/corazawaf/coraza/v3':45A '3.0.0':123C '3.8.0':125C,230C 'allow':7A 'although':211C 'appear':190C 'applic':119C 'attack':61B,136C,166C 'attacker-control':60B 'attacker-influenc':135C 'audit':4A,70B,129C,193C 'audit-log':3A,128C 'base':100B 'bodi':15A,172C 'boundari':215C 'break':79B,156C 'carriag':144C,184C 'charact':75B 'code':105B 'compat':117C 'complet':222C 'content':201C 'control':62B,168C 'coraza':1A,46B,54B,111C 'cr/lf':74B 'creat':81B,158C 'crlf':8A 'cve':23A,34A 'data':181C 'direct':104B 'enabl':153C 'error':175C 'error-messag':174C 'execut':106B 'feed':148C,188C 'field':18A,66B,141C 'firewal':120C 'fix':227C 'forg':82B,159C,192C,200C 'forgeri':12A,92B 'format':6A 'formatt':131C 'ghsa':27A 'ghsa-prpw-wwv7-xjjr':26A 'github.com':21A,38A,41A,44A 'github.com/corazawaf/coraza':20A,37A 'github.com/corazawaf/coraza/v2':40A 'github.com/corazawaf/coraza/v3':43A 'go':31A,47B,56B 'golang':115C 'header':17A,173C 'host':52B 'imperson':218C 'influenc':137C 'inject':9A,77B,154C,183C 'insid':84B,161C 'internal/auditlog/formats.go':133C 'issu':225C 'librari':58B,121C 'line':78B,83B,99B,147C,155C,160C,187C,194C,207C 'line-bas':98B 'line-ori':206C 'log':5A,11A,71B,91B,130C 'match':179C 'matched-rul':178C 'messag':176C 'mislead':95B,203C 'modsecur':48B,116C 'nativ':2A,69B,127C,151C 'neutral':143C 'oper':96B,204C 'orient':208C 'owasp':110C 'packag':49B 'pars':102B 'prevent':216C 'process':210C 'prpw':28A 'record':87B,164C,198C 'request':14A,63B,138C,169C 'respons':65B,140C,171C 'result':89B 'return':145C,185C 'rule':180C 'secauditlogformat':150C 'self':51B 'self-host':50B 'separ':221C 'session':108B,223C 'siem':101B,209C 'straightforward':217C 'strip':73B 'takeov':109B 'transact':86B,163C,197C,214C 'unpredict':213C 'version':229C 'via':13A 'waf':53B,57B,112C 'web':118C 'within':195C 'without':72B,142C 'write':59B,134C 'wwv7':29A 'xjjr':30A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T21:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6669","url":"https://pkg.go.dev/vuln/GO-2026-6669","severity":null,"published_at":"2026-10-20T00:20:51+00:00","modified_at":"2026-10-20T00:20:51+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-41504","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41504","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-41504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41504","severity":null,"published_at":"2026-10-12T21:17:17+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}