CVE-2026-107835

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. Exploitation depends on the backend parser and affected rule scope, and interior control characters with inconsistent backend behavior are outside this advisory's remediation. This issue is fixed in version 3.8.1.

• CWE-436

• https://github.com/corazawaf/coraza/commit/0b940e197ad9983fb3aa36e84f1f81ff985461af
• https://github.com/corazawaf/coraza/commit/9f8521398d1ff023b958fad0b944cac265763866
• https://github.com/corazawaf/coraza/releases/tag/v3.8.1
• https://github.com/corazawaf/coraza/security/advisories/GHSA-g4qm-m288-5cp9
• https://github.com/corazawaf/coraza/security/advisories/GHSA-g4qm-m288-5cp9

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107829Jivejdon through 5.0 contains a weak password storage vulner…5.9
• CVE-2026-10783A security flaw has been discovered in gradio-app gradio 6.1…2.5
• CVE-2026-107830Jivejdon from commit e0306088 through commit ee67a65e lacks …5.3
• CVE-2026-107831Jivejdon through 5.0 contains a cross-site request forgery v…4.3
• CVE-2026-107833OWASP Coraza WAF is a golang modsecurity compatible web appl…5.9
• CVE-2026-107834OWASP Coraza WAF is a golang modsecurity compatible web appl…5.3
• CVE-2026-107836RIOT is an open-source microcontroller operating system desi…7.1
• CVE-2026-107837RIOT is an open-source microcontroller operating system desi…8.2
• CVE-2026-107838RIOT is an open-source microcontroller operating system desi…7.5
• CVE-2026-107839ageLANServer provides a cross-platform web server and launch…7.5
• CVE-2026-107840yopass is a service for securely sharing secrets, passwords,…7.5
• CVE-2026-107841pacioli provides least-privilege governance and a governed a…5.7