CVE-2026-104774

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/corazawaf/coraza/commit/f9b7afdbcedce7ad814663eaee2e342578ea3bb2
https://github.com/corazawaf/coraza/releases/tag/v3.8.0
https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv
https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv

Configurations

No configuration.

History

13 Oct 2026, 16:17

Type	Values Removed	Values Added
References	~~() https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv -~~	() https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv -

12 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-12 20:17

Updated : 2026-10-16 20:04

NVD link : CVE-2026-104774

Mitre link : CVE-2026-104774

CVE.ORG link : CVE-2026-104774

JSON object : View

Products Affected

No product.

CWE

CWE-172

Encoding Error

CWE-193

Off-by-one Error

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-104774", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104774", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T15:56:13.215165Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "corazawaf", "product": "coraza", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.8.0"}]}]}], "published": "2026-10-12T20:17:07.617", "references": [{"url": "https://github.com/corazawaf/coraza/commit/f9b7afdbcedce7ad814663eaee2e342578ea3bb2", "source": "security-advisories@github.com"}, {"url": "https://github.com/corazawaf/coraza/releases/tag/v3.8.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv", "source": "security-advisories@github.com"}, {"url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-172"}, {"lang": "en", "value": "CWE-193"}, {"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0."}], "lastModified": "2026-10-16T20:04:29.760", "sourceIdentifier": "security-advisories@github.com"}