Web Application Firewall Vulnerability in Coraza by OWASP
CVE-2026-107833

5.9MEDIUM

Key Information:

Vendor

Corazawaf

Status
Coraza
Vendor
CVE Published:
9 October 2026

What is CVE-2026-107833?

The OWASP Coraza WAF exposes a vulnerability in its JSON response processing. Specifically, versions 3.0.0 through 3.8.0 utilize a flawed mechanism in the ProcessResponse function, allowing an attacker to exploit deeply nested JSON structures. When this occurs, the processing can consume substantial CPU resources, effectively leading to denial of service conditions. While request processing remains secure due to appropriate configuration limits, the flaw necessitates that response-body inspection be enabled for potential exploitation. The issue has been resolved in version 3.8.0.

Affected Version(s)

coraza >= 3.0.0, < 3.8.0

References

https://github.com/corazawaf/coraza/security/advisories/G...
x_refsource_CONFIRM
https://github.com/corazawaf/coraza/commit/cae3c7407e7b84...
x_refsource_MISC
https://github.com/corazawaf/coraza/releases/tag/v3.8.0
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.