CVE-2026-114099: corazawaf coraza, невалидиран вход

Описание

Оригинално описание

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Засегнати продукти

• corazawaf coraza: 3.0.0 преди 3.8.1; 3.8.1

Вид слабост

• CWE-20 Неправилно валидиране на входните данни

История

Други уязвимости в corazawaf coraza

• 6.3CVE-2026-114101
• 6.9CVE-2026-114100
• 5.8CVE-2026-41508
• 5.8CVE-2026-41504
• 5.8CVE-2026-104774

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-114099
• https://nvd.nist.gov/vuln/detail/CVE-2026-114099
• https://github.com/corazawaf/coraza/security/advisories/GHSA-5gj4-9gm7-2fx2
• https://www.vulncheck.com/advisories/coraza-3.0.0-before-3.8.1-waf-bypass-via-json-key-collision