Live › vulnerability › GHSA-5gj4-9gm7-2fx2
Go to dashboardCoraza, a Go web application firewall library, has a JSON body processor bug where duplicate or colliding keys let unauthenticated attackers slip requests past OWASP Core Rule Set inspection. An attacker gets malicious payloads through the WAF to the backend application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/corazawaf/coraza | go | all versions | – |
| github.com/corazawaf/coraza/v2 | go | all versions | – |
| github.com/corazawaf/coraza/v3 | go | >= 3.0.0, < 3.8.1 | 3.8.1 |
Run go list -m github.com/corazawaf/coraza/v3 and check whether the version is below 3.8.1.
Search go.mod files for github.com/corazawaf/coraza and note any version without a /v2 or /v3 suffix or below 3.8.1.
Upgrade github.com/corazawaf/coraza/v3 to or later.
3.8.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza
This page as .md · .json · in your agent: get_signal("GHSA-5gj4-9gm7-2fx2")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.