{"id":"GHSA-g4qm-m288-5cp9","kind":"vulnerability","aliases":["GHSA-g4qm-m288-5cp9","GO-2026-6694"],"related":[],"title":"Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza","description":"Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza","summary":"Coraza, a Go web application firewall library, has a cookie parser confusion bug, meaning it may read cookies differently than the backend application does. An attacker could craft cookies that slip past WAF rules that inspect them.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.1"],"affected":"< 3.8.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","package","self-hosted","waf"],"not_affected_if":["coraza-v3-at-3.8.1-or-later","not-using-coraza"],"how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` and check whether the version is below 3.8.1.","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.\nFor the unversioned and /v2 module paths, the sources do not give a fixed version: unknown.","status":"open","published_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:31+00:00","updated_at":"2026-10-23T20:15:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.\nFor the unversioned and /v2 module paths, the sources do not give a fixed version: unknown.","summary":"Coraza, a Go web application firewall library, has a cookie parser confusion bug, meaning it may read cookies differently than the backend application does. An attacker could craft cookies that slip past WAF rules that inspect them.","category":"package","who_cares":["go","coraza","waf","self-hosted"],"confidence":0.6,"analyst_note":"Check https://pkg.go.dev/vuln/GO-2026-6694 for the exact affected/fixed versions of the unversioned and /v2 module paths, and for the advisory detail on what cookie inputs bypass inspection.","how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` and check whether the version is below 3.8.1.\nunknown for other module paths (github.com/corazawaf/coraza and /v2 show fixed as unknown).","needs_analyst":true,"not_affected_if":["not-using-coraza","coraza-v3-at-3.8.1-or-later"],"severity_if_unknown":"unknown"},"cost_usd":0.000414,"input_tokens":2046,"output_tokens":419,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A '-6694':17A '/corazawaf/coraza':9A,25A,83C '/corazawaf/coraza/v2':28A '/corazawaf/coraza/v3':31A '5cp9':14A,22A 'applic':43B,61B 'attack':64B 'backend':60B 'bug':51B 'confus':5A,50B,79C 'cooki':3A,48B,56B,67B,77C 'coraza':1A,32B,39B,75C 'could':65B 'craft':66B 'differ':57B 'firewal':44B 'g4qm':12A,20A 'ghsa':11A,19A 'ghsa-g4qm-m288-5cp9':10A,18A 'github.com':8A,24A,27A,30A,82C 'github.com/corazawaf/coraza':7A,23A,81C 'github.com/corazawaf/coraza/v2':26A 'github.com/corazawaf/coraza/v3':29A 'go':15A,33B,41B 'host':37B 'inspect':74B 'librari':45B 'm288':13A,21A 'may':54B 'mean':52B 'packag':34B 'parser':4A,49B,78C 'past':70B 'read':55B 'rule':72B 'self':36B 'self-host':35B 'slip':69B 'waf':38B,71B 'web':42B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6694","url":"https://pkg.go.dev/vuln/GO-2026-6694","severity":null,"published_at":"2026-10-19T21:08:17+00:00","modified_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}