{"id":"GHSA-w253-m66g-rx24","kind":"vulnerability","aliases":["GHSA-w253-m66g-rx24","GO-2026-6698"],"related":[],"title":"Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza","description":"Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza","summary":"Coraza, a Go web application firewall library, can be made to skip request body inspection when a URL-encoded form Content-Type carries extra parameters. An attacker can send malicious payloads in the body that the WAF rules never see.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.1"],"affected":">= 3.0.4, < 3.8.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","package","self-hosted","waf"],"not_affected_if":["body-inspection-disabled","no-go-dependency"],"how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` in the project and check whether the version is at least 3.8.1.","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.\nFor github.com/corazawaf/coraza and /v2, the fixed version is unknown; check the advisory or pkg.go.dev before deciding.","status":"open","published_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:31+00:00","updated_at":"2026-10-23T20:15:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.\nFor github.com/corazawaf/coraza and /v2, the fixed version is unknown; check the advisory or pkg.go.dev before deciding.","summary":"Coraza, a Go web application firewall library, can be made to skip request body inspection when a URL-encoded form Content-Type carries extra parameters. An attacker can send malicious payloads in the body that the WAF rules never see.","category":"package","who_cares":["go","coraza","waf","self-hosted"],"confidence":0.6,"analyst_note":"Confirm fixed versions for the non-v3 module paths (github.com/corazawaf/coraza and /v2) at https://pkg.go.dev/vuln/GO-2026-6698 and check the GHSA page for severity and exploit details.","how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` in the project and check whether the version is at least 3.8.1.\nunknown for the other module paths: the sources list them as affected with no fixed version.","needs_analyst":true,"not_affected_if":["no-go-dependency","body-inspection-disabled"],"severity_if_unknown":"unknown"},"cost_usd":0.000421,"input_tokens":2081,"output_tokens":426,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':24A '-6698':25A '/corazawaf/coraza':17A,33A,105C '/corazawaf/coraza/v2':36A '/corazawaf/coraza/v3':39A 'applic':51B 'attack':75B 'bodi':12A,60B,82B,100C 'bypass':10A,98C 'carri':71B 'content':7A,69B,95C 'content-typ':6A,68B,94C 'coraza':1A,11A,40B,47B,89C,99C 'encod':4A,66B,92C 'extra':72B 'firewal':52B 'form':5A,67B,93C 'ghsa':19A,27A 'ghsa-w253-m66g-rx24':18A,26A 'github.com':16A,32A,35A,38A,104C 'github.com/corazawaf/coraza':15A,31A,103C 'github.com/corazawaf/coraza/v2':34A 'github.com/corazawaf/coraza/v3':37A 'go':23A,41B,49B 'host':45B 'inspect':13A,61B,101C 'librari':53B 'm66g':21A,29A 'made':56B 'malici':78B 'never':87B 'packag':42B 'paramet':9A,73B,97C 'payload':79B 'request':59B 'rule':86B 'rx24':22A,30A 'see':88B 'self':44B 'self-host':43B 'send':77B 'skip':58B 'type':8A,70B,96C 'url':3A,65B,91C 'url-encod':2A,64B,90C 'w253':20A,28A 'waf':46B,85B 'web':50B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6698","url":"https://pkg.go.dev/vuln/GO-2026-6698","severity":null,"published_at":"2026-10-19T21:08:17+00:00","modified_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}