Live › vulnerability › GHSA-g4qm-m288-5cp9
Go to dashboardCoraza, a Go web application firewall library, has a cookie parser confusion bug, meaning it may read cookies differently than the backend application does. An attacker could craft cookies that slip past WAF rules that inspect them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/corazawaf/coraza | go | all versions | – |
| github.com/corazawaf/coraza/v2 | go | all versions | – |
| github.com/corazawaf/coraza/v3 | go | < 3.8.1 | 3.8.1 |
Run go list -m github.com/corazawaf/coraza/v3 and check whether the version is below 3.8.1.
3.8.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza
This page as .md · .json · in your agent: get_signal("GHSA-g4qm-m288-5cp9")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.