CVE-2026-107825 in Coraza
Summary
by MITRE • 10/09/2026
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. The bundled coraza/v3/http integration is not affected because Go net/http rejects such malformed request targets before calling Coraza. This issue is fixed in version 3.8.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within OWASP Coraza versions ranging from 3.0.0 to 3.8.0 represents a critical logic flaw in the handling of Uniform Resource Identifier parsing failures, specifically affecting the ProcessURI function located in the internal/corazawaf/transaction.go module. As a Web Application Firewall library written in Go and designed for compatibility with ModSecurity, Coraza relies on accurate extraction of request components to enforce security rules effectively. The core technical flaw arises when the underlying Go standard library function url.ParseRequestURI fails to parse a provided URI due to malformed syntax or invalid characters. Instead of rejecting the transaction outright or resetting all parsed variables to safe defaults, the implementation retains the raw, unparsed URI string while simultaneously leaving critical query-related data structures empty. Specifically, the QUERY_STRING variable remains unset, and the ARGS_GET, ARGS_GET_NAMES, and any other GET-derived portions of the ARGS collection are left blank despite the presence of a potentially malicious or complex request target.
This inconsistent state creates a significant security gap that can be exploited by unauthenticated attackers to bypass WAF rules through parameter pollution techniques. When an integration such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts receives the transaction object from Coraza, these downstream components may still attempt to process query parameters directly from the raw URI string rather than relying solely on the empty ARGS structures populated by Coraza. Consequently, an attacker can inject control bytes or encoded malicious payloads into the URI that bypasses Coraza's rule evaluation because the WAF sees no arguments in its internal state, yet the backend application processes them as valid query parameters. This discrepancy allows attackers to execute cross-site scripting, SQL injection, or other command injection attacks by hiding their payload within the raw request target where it is invisible to the security rules configured for ARGS_GET variables.
The operational impact of this vulnerability is severe in environments utilizing Coraza with non-standard integrations that do not strictly adhere to Go's net/http parsing standards before invoking the WAF engine. The bundled coraza/v3/http integration remains unaffected because the standard library rejects malformed request targets at a lower level, preventing them from ever reaching the Coraza transaction processing logic. However, in scenarios where developers implement custom HTTP handlers or use alternative proxy frameworks that pass raw URIs directly to Coraza without pre-validation, the WAF becomes effectively blind to query-based attacks embedded within those malformed requests. This leads to a false sense of security where rules targeting GET parameters fail to trigger, allowing malicious traffic to reach the backend application unfiltered and potentially compromising data integrity or confidentiality.
From an industry standard perspective, this vulnerability aligns with CWE-20 Improper Input Validation as it involves failing to properly validate and sanitize input before processing, leading to inconsistent internal state representation. It also relates closely to CWE-841 Improper Enforcement of Behavioral Constraints because the WAF fails to enforce its intended behavior of blocking or flagging malformed requests that could lead to rule bypasses. In terms of MITRE ATT&CK mapping, this flaw facilitates techniques associated with Tactic TA0005 Defense Evasion and specifically Technique T1190 Exploit Public-Facing Application by allowing attackers to evade detection mechanisms through input manipulation. The vulnerability underscores the importance of consistent state management in security middleware where partial failures must not result in silent degradation of protection capabilities.
To mitigate this risk, organizations running Coraza versions prior to 3.8.0 should immediately upgrade to version 3.8.0 or later, which resolves the issue by ensuring that parsing failures are handled consistently without leaving critical variables in an ambiguous empty state while retaining raw input. For environments where upgrading is not immediately feasible, developers implementing custom integrations must implement strict pre-validation of request URIs using Go's net/http package standards before passing them to Coraza. This includes rejecting any requests with malformed targets or ensuring that query parameters are extracted and validated independently if the WAF cannot parse them correctly. Additionally, security teams should audit their rule sets to ensure they do not rely exclusively on ARGS_GET variables for critical protections without complementary checks against raw URI content or QUERY_STRING fields where applicable, thereby reducing reliance on a single point of failure in the parsing logic.