Web Application Firewall Vulnerability in OWASP Coraza by Coraza Technologies
CVE-2026-41510

7.2HIGH

Key Information:

Vendor

Corazawaf

Status
Coraza
Vendor
CVE Published:
12 October 2026

What is CVE-2026-41510?

The OWASP Coraza WAF, a golang-based ModSecurity compatible web application firewall, has a vulnerability in versions 3.0.0 through 3.8.1 that affects how it handles excessive arguments in requests. When an attacker sends more arguments than the SecArgumentsLimit configuration, those excess values are silently omitted during processing. This can lead to security rules not being correctly applied, allowing unvalidated input to reach the downstream application. Additionally, the flaw can invoke excessive memory consumption from the affected URL-encoded and JSON processing methods, potentially degrading service performance. This vulnerability is addressed in version 3.8.1.

Affected Version(s)

coraza >= 3.0.0, < 3.8.1

References

https://github.com/corazawaf/coraza/security/advisories/G...
x_refsource_CONFIRM
https://github.com/corazawaf/coraza/commit/146c2f79f39ad1...
x_refsource_MISC
https://github.com/corazawaf/coraza/commit/b98359bb7e7606...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.