CVE-2026-114099 corazawaf CVE debrief

Who should care

Defenders responsible for Coraza configurations and deployments should assess exposure and implement compensating controls to prevent similar attacks. This includes reviewing Coraza configurations, identifying potential vulnerable deployments, and verifying vendor remediation. Additionally, defenders should monitor for suspicious activity and exception tracking, and implement compensating controls to detect and prevent similar attacks.

Why it matters

The Coraza JSON body processor vulnerability allows unauthenticated attackers to bypass OWASP CRS inspection, enabling potential SQL-injection attacks. Defenders must assess exposure, implement compensating controls, and verify vendor remediation to prevent similar attacks.

• Defenders must verify Coraza configurations to prevent bypass of OWASP CRS inspection.
• Compensating controls are necessary to detect and prevent similar attacks.
• Vendor remediation must be verified to ensure patching of the vulnerability.
• Monitoring for suspicious activity and exception tracking is crucial.

Technical summary

The Coraza JSON body processor converts nested JSON properties into dot-separated ARGS_POST names without escaping dots in property names. This allows two distinct JSON properties to collapse into the same Coraza variable, enabling an unauthenticated attacker to bypass OWASP CRS inspection. The vulnerability arises from the processor's inability to handle nested properties with dots, allowing an attacker to overwrite a malicious value with a harmless dotted property. For example, an attacker can place a malicious value in a nested property and then overwrite only Coraza's representation with a harmless dotted property. This bypasses the complete current OWASP Core Rule Set (CRS) for the hidden value.

Defensive priority

Defenders should prioritize assessing exposure and implementing compensating controls, as the vulnerability allows for bypassing of OWASP Core Rule Set (CRS) inspection.

Recommended defensive actions

• Assess exposure by reviewing Coraza configurations and identifying potential vulnerable deployments.
• Implement compensating controls to detect and prevent similar attacks.
• Verify vendor remediation by checking for updates to Coraza.
• Monitor for suspicious activity and exception tracking.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in Coraza's JSON body processor, which converts nested JSON properties into dot-separated ARGS_POST names without escaping dots in property names. This allows an unauthenticated attacker to bypass OWASP CRS inspection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.