{"id":"GHSA-x26q-wvhg-fh4m","kind":"vulnerability","aliases":["GHSA-x26q-wvhg-fh4m","GO-2026-6699"],"related":[],"title":"Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza","description":"Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza","summary":"Coraza, a Go web application firewall library, silently drops QUERY_STRING and ARGS_GET when a URI fails to parse in ProcessURI, so WAF rules that inspect query parameters do not see them. An attacker can send crafted URIs that evade query-based rules in integrations that do not use net/http.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.0"],"affected":">= 3.0.0, < 3.8.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","package","self-hosted","waf"],"not_affected_if":["net-http-only-integration","version-3.8.0-or-later"],"how_to_check":"Run go list -m github.com/corazawaf/coraza/v3 in the project and check whether the version is below 3.8.0.\nSearch the codebase for coraza imports and check whether the integration is a non-net/http connector.","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.","status":"open","published_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:34+00:00","updated_at":"2026-10-23T20:15:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:34Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.\nunknown","summary":"Coraza, a Go web application firewall library, silently drops QUERY_STRING and ARGS_GET when a URI fails to parse in ProcessURI, so WAF rules that inspect query parameters do not see them. An attacker can send crafted URIs that evade query-based rules in integrations that do not use net/http.","category":"package","who_cares":["go","coraza","waf","self-hosted"],"confidence":0.6,"analyst_note":"Sources do not state the CVSS severity, exploit details, or whether the bypass affects the net/http integration; check https://pkg.go.dev/vuln/GO-2026-6699 and the GHSA page for the affected integration path and severity.","how_to_check":"Run go list -m github.com/corazawaf/coraza/v3 in the project and check whether the version is below 3.8.0.\nSearch the codebase for coraza imports and check whether the integration is a non-net/http connector.\nunknown","needs_analyst":true,"not_affected_if":["version-3.8.0-or-later","net-http-only-integration"],"severity_if_unknown":"medium"},"cost_usd":0.000423,"input_tokens":2141,"output_tokens":418,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':35A '-6699':36A '/corazawaf/coraza':28A,44A,137C '/corazawaf/coraza/v2':47A '/corazawaf/coraza/v3':50A '/http':23A,132C 'applic':62B 'arg':8A,70B,117C 'attack':92B 'base':101B 'bypass':18A,127C 'coraza':1A,51B,58B,110C 'craft':95B 'defens':15A,124C 'defense-in-depth':14A,123C 'depth':17A,126C 'drop':4A,66B,113C 'evad':98B 'fail':75B 'failur':13A,122C 'fh4m':33A,41A 'firewal':63B 'get':9A,71B,118C 'ghsa':30A,38A 'ghsa-x26q-wvhg-fh4m':29A,37A 'github.com':27A,43A,46A,49A,136C 'github.com/corazawaf/coraza':26A,42A,135C 'github.com/corazawaf/coraza/v2':45A 'github.com/corazawaf/coraza/v3':48A 'go':34A,52B,60B 'host':56B 'inspect':84B 'integr':24A,104B,133C 'librari':64B 'net':22A,131C 'net/http':109B 'non':21A,130C 'non-net':20A,129C 'packag':53B 'paramet':86B 'pars':12A,77B,121C 'processuri':2A,79B,111C 'queri':5A,67B,85B,100B,114C 'query-bas':99B 'rule':82B,102B 'see':89B 'self':55B 'self-host':54B 'send':94B 'silent':3A,65B,112C 'string':6A,68B,115C 'uri':11A,74B,96B,120C 'use':108B 'waf':57B,81B 'web':61B 'wvhg':32A,40A 'x26q':31A,39A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6699","url":"https://pkg.go.dev/vuln/GO-2026-6699","severity":null,"published_at":"2026-10-19T21:08:17+00:00","modified_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}