---
id: "GHSA-5gj4-9gm7-2fx2"
kind: "vulnerability"
aliases: ["GHSA-5gj4-9gm7-2fx2", "GO-2026-6692"]
title: "Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/corazawaf/coraza", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/corazawaf/coraza/v2", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/corazawaf/coraza/v3", "fixed": ["3.8.1"], "affected": ">= 3.0.0, < 3.8.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["coraza", "go", "owasp-crs", "package", "self-hosted", "waf"]
not_affected_if: ["no-json-body-inspection", "not-using-coraza"]
published_at: "2026-10-19T21:08:17+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T20:15:32+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6692", "first_seen_at": "2026-10-23T19:13:08+00:00"}]
---

# Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza

Coraza, a Go web application firewall library, has a JSON body processor bug where duplicate or colliding keys let unauthenticated attackers slip requests past OWASP Core Rule Set inspection. An attacker gets malicious payloads through the WAF to the backend application.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/corazawaf/coraza affected all versions fixed ?
- go:github.com/corazawaf/coraza/v2 affected all versions fixed ?
- go:github.com/corazawaf/coraza/v3 affected >= 3.0.0, < 3.8.1 fixed 3.8.1

## How to check

Run `go list -m github.com/corazawaf/coraza/v3` and check whether the version is below 3.8.1.
Search go.mod files for github.com/corazawaf/coraza and note any version without a /v2 or /v3 suffix or below 3.8.1.

## Fix

Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6692

## From the sources

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_