CVE Tools
Track your stack

Github.com/corazawaf/coraza/v3

10 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Github.com/corazawaf/coraza/v3, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Github.com/corazawaf/coraza/v3 CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Github.com/corazawaf/coraza/v3 CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-031
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-108

Severity

How the 10 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • High150%
  • Medium150%

Latest CVEs

The 10 most recently published vulnerabilities affecting Github.com/corazawaf/coraza/v3.

  1. GHSA-rp9v-7xv3-r6g3Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor—
  2. GHSA-w253-m66g-rx24Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection—
  3. GHSA-3c6w-j9xm-8h2hCoraza: Unbounded recursion in JSON response body processor causes CPU exhaustion—
  4. GHSA-3wr7-993q-jrffCoraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules—
  5. GHSA-g4qm-m288-5cp9Coraza has Cookie Parser Confusion—
  6. GHSA-x26q-wvhg-fh4mCoraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations—
  7. GHSA-6gcq-wc29-5xf2Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)—
  8. GHSA-5gj4-9gm7-2fx2Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection—
  9. CVE-2025-29914OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`5.4
  10. CVE-2023-40586go package github.com/corazawaf/coraza is vulnerable to denial of service7.5

Product grouping is registry-driven, with AI assist and human review. How it works