CVE-2026-114100: corazawaf coraza, невалидиран вход

Описание

Оригинално описание

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.

Засегнати продукти

• corazawaf coraza: 3.0.4 преди 3.8.1; 3.8.1

Вид слабост

• CWE-20 Неправилно валидиране на входните данни

История

Други уязвимости в corazawaf coraza

• 6.3CVE-2026-114101
• 6.9CVE-2026-114099
• 5.8CVE-2026-41508
• 5.8CVE-2026-41504
• 5.8CVE-2026-104774

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-114100
• https://nvd.nist.gov/vuln/detail/CVE-2026-114100
• https://github.com/corazawaf/coraza/security/advisories/GHSA-w253-m66g-rx24
• https://www.vulncheck.com/advisories/coraza-from-3.0.4-before-3.8.1-request-body-inspection-bypass-via-content-type