{"id":"GHSA-6gcq-wc29-5xf2","kind":"vulnerability","aliases":["GHSA-6gcq-wc29-5xf2","GO-2026-6693"],"related":[],"title":"Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza","description":"Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza","summary":"Coraza, a Go web application firewall library, can be made to crash its host process through a deeply nested JSON request body that overflows the stack during validation. An attacker who can send HTTP requests to a service using the affected Coraza WAF can trigger the crash.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.1"],"affected":">= 3.0.0, < 3.8.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","package","self-hosted","waf"],"not_affected_if":["json-body-processing-disabled","not-using-coraza"],"how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` in the project and check whether the version is below 3.8.1.","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.","status":"open","published_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:29+00:00","updated_at":"2026-10-23T20:15:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:29Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.\nunknown","summary":"Coraza, a Go web application firewall library, can be made to crash its host process through a deeply nested JSON request body that overflows the stack during validation. An attacker who can send HTTP requests to a service using the affected Coraza WAF can trigger the crash.","category":"package","who_cares":["go","coraza","waf","self-hosted"],"confidence":0.6,"analyst_note":"Confirm the exact fix for the non-v3 module paths (github.com/corazawaf/coraza and /v2 show fixed ?) and check https://pkg.go.dev/vuln/GO-2026-6693 for the affected-version details and whether the default config processes JSON bodies.","how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` in the project and check whether the version is below 3.8.1.\nunknown","needs_analyst":true,"not_affected_if":["not-using-coraza","json-body-processing-disabled"],"severity_if_unknown":"unknown"},"cost_usd":0.000402,"input_tokens":2119,"output_tokens":380,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':29A '-6693':30A '/corazawaf/coraza':22A,38A,120C '/corazawaf/coraza/v2':41A '/corazawaf/coraza/v3':44A '5xf2':27A,35A '6gcq':25A,33A 'affect':92B 'applic':56B 'argument':6A,104C 'argument-limit':5A,103C 'attack':81B 'bodi':3A,73B,101C 'coraza':1A,45B,52B,93B,99C 'crash':18A,63B,98B,116C 'deepli':69B 'depth':13A,111C 'firewal':57B 'ghsa':24A,32A 'ghsa-6gcq-wc29-5xf2':23A,31A 'github.com':21A,37A,40A,43A,119C 'github.com/corazawaf/coraza':20A,36A,118C 'github.com/corazawaf/coraza/v2':39A 'github.com/corazawaf/coraza/v3':42A 'gjson.valid':14A,112C 'go':28A,46B,54B 'host':50B,65B 'http':85B 'json':2A,71B,100C 'librari':58B 'limit':7A,105C 'made':61B 'nest':70B 'overflow':16A,75B,114C 'packag':47B 'process':17A,66B,115C 'processor':4A,102C 'reopen':9A,107C 'request':72B,86B 'self':49B 'self-host':48B 'send':84B 'servic':89B 'stack':15A,77B,113C 'trigger':96B 'truncat':8A,106C 'unbound':12A,110C 'unbounded-depth':11A,109C 'use':90B 'valid':79B 'waf':51B,94B 'wc29':26A,34A 'web':55B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6693","url":"https://pkg.go.dev/vuln/GO-2026-6693","severity":null,"published_at":"2026-10-19T21:08:17+00:00","modified_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}