CVE-2026-107826 in Coraza
Summary
by MITRE • 10/09/2026
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
OWASP Coraza WAF serves as a Go-based implementation of ModSecurity compatible web application firewall logic, designed to inspect HTTP traffic for malicious patterns. A critical vulnerability exists within the JSON body processing module, specifically affecting versions from 3.0.0 through 3.8.1. The flaw resides in the readJSON function located in internal/bodyprocessors/json.go, which is responsible for parsing and validating incoming JSON payloads against security rules. This component utilizes a bounded flattening walk to process arguments up to limits defined by SecArgumentsLimit or a specific byte budget. However, this validation mechanism contains a logic gap that allows an attacker to bypass the depth restrictions intended to prevent resource exhaustion attacks.
The technical nature of this vulnerability is rooted in how the parser handles incomplete JSON structures. When the bounded walk reaches its predefined limit for arguments or bytes, it ceases processing the current path but subsequently invokes gjson.Valid on the complete raw body string rather than just the processed portion. The gjson library performs recursive validation to ensure syntactic correctness and does not enforce a depth limit during this specific validity check. Consequently, an unauthenticated attacker can craft a malicious payload consisting of shallow initial values that satisfy the argument count or byte budget limits, followed by an extremely deeply nested JSON structure in the remaining data stream. Because the bounded walk stops early, it fails to detect the excessive nesting depth within the tail end of the payload.
This architectural oversight leads directly to a denial of service condition characterized by an unrecoverable fatal stack overflow. As gjson.Valid recursively traverses the deeply nested JSON tail without any recursion limit, the call stack expands until it exceeds the available memory allocated for goroutines or threads in the Go runtime environment. This results in the termination of the hosting process, effectively taking down the web application firewall and potentially disrupting all traffic passing through it. The attack is particularly insidious because the payload can remain within recommended body-size and argument-count limits, allowing it to bypass standard size-based filtering rules that are typically configured on WAFs to mitigate large-payload attacks.
The impact of this vulnerability extends beyond simple service disruption. Since both ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, an attacker can trigger this crash via incoming requests or potentially through responses processed by the engine if it is used in reverse proxy modes. The ability to cause a stack overflow with small, compliant-sized payloads means that traditional rate limiting or size-based mitigation strategies are insufficient defenses against this specific exploit vector. This represents a significant availability risk for organizations relying on Coraza WAF versions within the affected range to protect their web applications from external threats.
Mitigation requires an immediate upgrade to version 3.8.1, where the developers have addressed this logic error by ensuring that depth limits are consistently applied during all stages of JSON validation, including the final validity check. Until such updates can be deployed, administrators should consider implementing strict request size limits at the network or reverse proxy level preceding the WAF to prevent large payloads from reaching the vulnerable component. Additionally, deploying runtime protection mechanisms capable of detecting and terminating goroutines that exceed stack depth thresholds may provide a temporary layer of defense against exploitation attempts. This vulnerability aligns with CWE-787 Out-of-bounds Write in terms of memory corruption consequences, although it manifests specifically as resource exhaustion via stack overflow, which is categorized under CWE-400 Uncontrolled Resource Consumption within the Common Weakness Enumeration framework. From an ATT&CK perspective, this exploit technique falls under T1496 Resource Hijacking or more broadly under Denial of Service tactics aimed at disrupting service availability rather than compromising data integrity or confidentiality.