CVE-2026-107833 in Coraza
Summary
by MITRE • 10/09/2026
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in OWASP Coraza Web Application Firewall versions ranging from 3.0.0 through 3.8.0 represents a significant resource exhaustion flaw rooted in the handling of recursive JSON parsing during response body inspection. As a golang library compatible with ModSecurity, Coraza serves as a critical security control for many modern web applications by inspecting incoming and outgoing traffic to detect malicious patterns. The specific defect resides within the internal processing logic responsible for analyzing JSON-formatted responses. When the firewall is configured to enable response-body inspection, it invokes the ProcessResponse function which delegates parsing tasks to readJSON in the bodyprocessors/json.go module. A critical logical error occurs here where the ignoreJSONRecursionLimit parameter is hardcoded or passed with a value of negative one. This configuration choice bypasses the intended recursive depth guardrails because the internal recursion check logic only terminates when it encounters zero, effectively leaving the parser vulnerable to processing arbitrarily deep JSON structures without hitting the expected safety limits.
This architectural oversight allows a network attacker who can influence the application protected by Coraza to return deeply nested or excessively complex JSON payloads in its responses. Upon receiving such a payload, the WAF attempts to parse and inspect it for security threats. Due to the disabled recursion limit, the parser does not abort early when encountering excessive nesting levels. Instead, it proceeds to perform quadratic computational work relative to the depth of the structure. This results in severe CPU consumption, potentially dedicating one full core for several seconds per response while operating within the default ResponseBodyLimit constraints. The impact is a denial of service condition where legitimate traffic may be delayed or dropped due to resource saturation caused by the WAF itself struggling with maliciously crafted responses rather than blocking them efficiently.
It is important to note that this specific exploitation vector does not affect request JSON processing, as that pathway utilizes a separate configuration for recursion limits which remains intact and functional. Therefore, an attacker must specifically target applications where response-body inspection is enabled within the Coraza deployment. The operational impact extends beyond simple performance degradation; it undermines the reliability of the security control by making the WAF itself a point of failure under targeted load. This aligns with CWE-400, which describes uncontrolled resource consumption, and can be mapped to MITRE ATT&CK techniques related to Resource Hijacking or Denial of Service via application layer attacks. The vulnerability highlights the risks associated with bypassing safety mechanisms in security software, as the tool meant to protect infrastructure becomes a liability when processing malformed input.
The issue was addressed in version 3.8.0 by correcting the logic that handles recursion limits during response body parsing. Administrators and developers utilizing OWASP Coraza must upgrade to this patched version or later to ensure that recursive JSON structures are properly truncated before they can cause excessive computational load. Until such an update is applied, organizations should consider disabling response-body inspection for untrusted sources if feasible, or implementing external rate limiting mechanisms to mitigate the potential impact of this resource exhaustion flaw. Maintaining up-to-date security components is essential to prevent attackers from leveraging implementation details in WAF logic against the protected environment itself.