CVE-2026-107825

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. The bundled coraza/v3/http integration is not affected because Go net/http rejects such malformed request targets before calling Coraza. This issue is fixed in version 3.8.0.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/corazawaf/coraza/commit/0321af96cef18fbafb40980cf075d7cc449a66fa
https://github.com/corazawaf/coraza/releases/tag/v3.8.0
https://github.com/corazawaf/coraza/security/advisories/GHSA-x26q-wvhg-fh4m
https://github.com/corazawaf/coraza/security/advisories/GHSA-x26q-wvhg-fh4m

Configurations

No configuration.

History

14 Oct 2026, 03:17

Type	Values Removed	Values Added
References	~~() https://github.com/corazawaf/coraza/security/advisories/GHSA-x26q-wvhg-fh4m -~~	() https://github.com/corazawaf/coraza/security/advisories/GHSA-x26q-wvhg-fh4m -

09 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-09 18:17

Updated : 2026-10-16 17:16

NVD link : CVE-2026-107825

Mitre link : CVE-2026-107825

CVE.ORG link : CVE-2026-107825

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-436

Interpretation Conflict

{"id": "CVE-2026-107825", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107825", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T02:03:57.850230Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "corazawaf", "product": "coraza", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.8.0"}]}]}], "published": "2026-10-09T18:17:04.503", "references": [{"url": "https://github.com/corazawaf/coraza/commit/0321af96cef18fbafb40980cf075d7cc449a66fa", "source": "security-advisories@github.com"}, {"url": "https://github.com/corazawaf/coraza/releases/tag/v3.8.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-x26q-wvhg-fh4m", "source": "security-advisories@github.com"}, {"url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-x26q-wvhg-fh4m", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-436"}]}], "descriptions": [{"lang": "en", "value": "OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. The bundled coraza/v3/http integration is not affected because Go net/http rejects such malformed request targets before calling Coraza. This issue is fixed in version 3.8.0."}], "lastModified": "2026-10-16T17:16:41.300", "sourceIdentifier": "security-advisories@github.com"}