CVE-2026-41510

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.

• CWE-693
• CWE-770

• https://github.com/corazawaf/coraza/commit/146c2f79f39ad16f13787e7d67ad400f8d8cb9a3
• https://github.com/corazawaf/coraza/commit/b98359bb7e7606c95100dcc7ad490d2d624e6dea
• https://github.com/corazawaf/coraza/releases/tag/v3.8.1
• https://github.com/corazawaf/coraza/security/advisories/GHSA-6r3q-mjv7-xr8m
• https://github.com/corazawaf/coraza/security/advisories/GHSA-6r3q-mjv7-xr8m

Published

Oct 12, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41505RELATE is a web-based courseware package. Prior to commit 2f…8.7
• CVE-2026-41506go-git is an extensible git implementation library written i…7.4
• CVE-2026-41507math-codegen generates code from mathematical expressions. P…9.8
• CVE-2026-41508OWASP Coraza WAF is a golang modsecurity compatible web appl…5.8
• CVE-2026-41509CROSS implementation contains reference and optimized implem…9.8
• CVE-2026-4151GIMP ANI File Parsing Integer Overflow Remote Code Execution…7.8
• CVE-2026-41511OpenMcdf is a fully .NET / C# library to manipulate Compound…5.5
• CVE-2026-41512ai-scanner is an AI model safety scanner built on NVIDIA gar…9.9
• CVE-2026-41513Horilla is an HR and CRM software. In 1.5.0, the notificatio…4.8
• CVE-2026-41514OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3
• CVE-2026-41515OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3
• CVE-2026-41516OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3