{"id":"GHSA-5gj4-9gm7-2fx2","kind":"vulnerability","aliases":["GHSA-5gj4-9gm7-2fx2","GO-2026-6692"],"related":[],"title":"Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza","description":"Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza","summary":"Coraza, a Go web application firewall library, has a JSON body processor bug where duplicate or colliding keys let unauthenticated attackers slip requests past OWASP Core Rule Set inspection. An attacker gets malicious payloads through the WAF to the backend application.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.1"],"affected":">= 3.0.0, < 3.8.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","owasp-crs","package","self-hosted","waf"],"not_affected_if":["no-json-body-inspection","not-using-coraza"],"how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` and check whether the version is below 3.8.1.\nSearch go.mod files for github.com/corazawaf/coraza and note any version without a /v2 or /v3 suffix or below 3.8.1.","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.","status":"open","published_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:32+00:00","updated_at":"2026-10-23T20:15:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:15:32Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.\nunknown for the non-v3 module paths, since the sources list them as affected with no fixed version.","summary":"Coraza, a Go web application firewall library, has a JSON body processor bug where duplicate or colliding keys let unauthenticated attackers slip requests past OWASP Core Rule Set inspection. An attacker gets malicious payloads through the WAF to the backend application.","category":"package","who_cares":["go","coraza","waf","owasp-crs","self-hosted"],"confidence":0.7,"analyst_note":"Sources list github.com/corazawaf/coraza and /v2 as affected with fixed unknown; check https://pkg.go.dev/vuln/GO-2026-6692 and the GHSA advisory for the fixed versions and whether the base and v2 paths are patched.","how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` and check whether the version is below 3.8.1.\nSearch go.mod files for github.com/corazawaf/coraza and note any version without a /v2 or /v3 suffix or below 3.8.1.\nunknown","needs_analyst":true,"not_affected_if":["no-json-body-inspection","not-using-coraza"],"severity_if_unknown":"high"},"cost_usd":0.000442,"input_tokens":2109,"output_tokens":462,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':28A '-6692':29A '/corazawaf/coraza':21A,37A,115C '/corazawaf/coraza/v2':40A '/corazawaf/coraza/v3':43A '2fx2':26A,34A '5gj4':24A,32A '9gm7':25A,33A 'allow':10A,104C 'applic':58B,94B 'attack':12A,74B,84B,106C 'backend':93B 'bodi':2A,64B,96C 'bug':66B 'bypass':14A,108C 'collid':70B 'collis':8A,102C 'coraza':1A,44B,54B,95C 'core':79B 'crs':16A,48B,110C 'duplic':68B 'firewal':59B 'get':85B 'ghsa':23A,31A 'ghsa-5gj4-9gm7-2fx2':22A,30A 'github.com':20A,36A,39A,42A,114C 'github.com/corazawaf/coraza':19A,35A,113C 'github.com/corazawaf/coraza/v2':38A 'github.com/corazawaf/coraza/v3':41A 'go':27A,45B,56B 'host':52B 'inspect':17A,82B,111C 'json':6A,63B,100C 'key':7A,71B,101C 'let':72B 'librari':60B 'malici':86B 'owasp':15A,47B,78B,109C 'owasp-cr':46B 'packag':49B 'past':77B 'payload':87B 'processor':3A,65B,97C 'request':76B 'rule':80B 'self':51B 'self-host':50B 'set':81B 'slip':75B 'unauthent':11A,73B,105C 'waf':53B,90B 'web':57B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6692","url":"https://pkg.go.dev/vuln/GO-2026-6692","severity":null,"published_at":"2026-10-19T21:08:17+00:00","modified_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}