{"id":"GHSA-3c6w-j9xm-8h2h","kind":"vulnerability","aliases":["GHSA-3c6w-j9xm-8h2h","GO-2026-6690"],"related":[],"title":"Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza","description":"Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza","summary":"Coraza, a Go web application firewall library, has an unbounded recursion in its JSON response body processor. A crafted JSON response can make the WAF consume excessive CPU, causing denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.0"],"affected":">= 3.0.0, < 3.8.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","package","self-hosted","waf"],"not_affected_if":["response-body-inspection-disabled","version-3.8.0-or-later"],"how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` and check whether the version is >= 3.0.0 and < 3.8.0.","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.","status":"open","published_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:28+00:00","updated_at":"2026-10-23T20:15:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.\nunknown for github.com/corazawaf/coraza and /v2, whose fixed versions are not stated.","summary":"Coraza, a Go web application firewall library, has an unbounded recursion in its JSON response body processor. A crafted JSON response can make the WAF consume excessive CPU, causing denial of service.","category":"package","who_cares":["go","coraza","waf","self-hosted"],"confidence":0.6,"analyst_note":"Confirm fixed versions for the root module and /v2 at https://pkg.go.dev/vuln/GO-2026-6690 and check whether response body inspection is required to trigger it.","how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` and check whether the version is >= 3.0.0 and < 3.8.0.\nunknown","needs_analyst":true,"not_affected_if":["version-3.8.0-or-later","response-body-inspection-disabled"],"severity_if_unknown":"unknown"},"cost_usd":0.000395,"input_tokens":2089,"output_tokens":372,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':22A '-6690':23A '/corazawaf/coraza':15A,31A,91C '/corazawaf/coraza/v2':34A '/corazawaf/coraza/v3':37A '3c6w':18A,26A '8h2h':20A,28A 'applic':49B 'bodi':7A,60B,83C 'caus':9A,73B,85C 'consum':70B 'coraza':1A,38B,45B,77C 'cpu':10A,72B,86C 'craft':63B 'denial':74B 'excess':71B 'exhaust':11A,87C 'firewal':50B 'ghsa':17A,25A 'ghsa-3c6w-j9xm-8h2h':16A,24A 'github.com':14A,30A,33A,36A,90C 'github.com/corazawaf/coraza':13A,29A,89C 'github.com/corazawaf/coraza/v2':32A 'github.com/corazawaf/coraza/v3':35A 'go':21A,39B,47B 'host':43B 'j9xm':19A,27A 'json':5A,58B,64B,81C 'librari':51B 'make':67B 'packag':40B 'processor':8A,61B,84C 'recurs':3A,55B,79C 'respons':6A,59B,65B,82C 'self':42B 'self-host':41B 'servic':76B 'unbound':2A,54B,78C 'waf':44B,69B 'web':48B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6690","url":"https://pkg.go.dev/vuln/GO-2026-6690","severity":null,"published_at":"2026-10-19T21:08:17+00:00","modified_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}