CVE-2026-107833

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.

• CWE-674

• https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a
• https://github.com/corazawaf/coraza/releases/tag/v3.8.0
• https://github.com/corazawaf/coraza/security/advisories/GHSA-3c6w-j9xm-8h2h
• https://github.com/corazawaf/coraza/security/advisories/GHSA-3c6w-j9xm-8h2h

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107826OWASP Coraza WAF is a golang modsecurity compatible web appl…7.5
• CVE-2026-107828Jivejdon through 5.0 contains an authentication bypass vulne…6.5
• CVE-2026-107829Jivejdon through 5.0 contains a weak password storage vulner…5.9
• CVE-2026-10783A security flaw has been discovered in gradio-app gradio 6.1…2.5
• CVE-2026-107830Jivejdon from commit e0306088 through commit ee67a65e lacks …5.3
• CVE-2026-107831Jivejdon through 5.0 contains a cross-site request forgery v…4.3
• CVE-2026-107834OWASP Coraza WAF is a golang modsecurity compatible web appl…5.3
• CVE-2026-107835OWASP Coraza WAF is a golang modsecurity compatible web appl…4
• CVE-2026-107836RIOT is an open-source microcontroller operating system desi…7.1
• CVE-2026-107837RIOT is an open-source microcontroller operating system desi…8.2
• CVE-2026-107838RIOT is an open-source microcontroller operating system desi…7.5
• CVE-2026-107839ageLANServer provides a cross-platform web server and launch…7.5