Live › vulnerability › GHSA-w253-m66g-rx24
Go to dashboardCoraza, a Go web application firewall library, can be made to skip request body inspection when a URL-encoded form Content-Type carries extra parameters. An attacker can send malicious payloads in the body that the WAF rules never see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/corazawaf/coraza | go | all versions | – |
| github.com/corazawaf/coraza/v2 | go | all versions | – |
| github.com/corazawaf/coraza/v3 | go | >= 3.0.4, < 3.8.1 | 3.8.1 |
Run go list -m github.com/corazawaf/coraza/v3 in the project and check whether the version is at least 3.8.1.
3.8.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza
This page as .md · .json · in your agent: get_signal("GHSA-w253-m66g-rx24")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.