CVE-2026-107835 corazawaf CVE debrief

Who should care

Defenders using Coraza WAF versions prior to 3.8.1 should assess exposure and prioritize remediation. Those responsible for WAF configuration, security monitoring, and incident response should review the vulnerability and its potential impact.

Why it matters

Defenders should care about CVE-2026-107835 because it affects OWASP Coraza WAF's cookie parser, potentially causing WAF to miss attacker data or drop cookies. Those using Coraza WAF versions prior to 3.8.1 should assess exposure and prioritize remediation.

• Potential for WAF to miss application-visible attacker data.
• Possible cookie indexing or dropping under different names or values.
• Need for verification of backend parser and WAF rule scope.
• Remediation priority for Coraza WAF versions prior to 3.8.1.

Technical summary

OWASP Coraza WAF's internal/cookies.ParseCookies function handles boundary ASCII control characters and control-only or empty cookie names differently than several backend cookie parsers. An unauthenticated attacker can craft a Cookie header to cause Coraza to index or drop a cookie under a different name or value than the backend application. The issue affects OWASP Coraza WAF versions prior to 3.8.1, and defenders should assess exposure and prioritize remediation. The vulnerability is confirmed by multiple sources, including the CVE Program and NIST NVD.

Defensive priority

Defenders should prioritize assessment and remediation of this vulnerability, especially those using Coraza WAF versions prior to 3.8.1.

Recommended defensive actions

• Assess exposure to CVE-2026-107835 by checking if Coraza WAF versions prior to 3.8.1 are in use.
• Verify that Coraza WAF is updated to version 3.8.1 or later.
• Review backend parser and WAF rule scope to understand potential impact.
• Monitor for unusual cookie handling behavior.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fixed version. The vulnerability is confirmed by multiple sources, including the CVE Program and NIST NVD. The issue affects OWASP Coraza WAF versions prior to 3.8.1, and defenders should verify the backend parser and WAF rule scope to understand potential impact. The source item and CVE record provide evidence of the vulnerability and its effects.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.