Vulnerability GO-2026-6690
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 hours ago
October 19, 2026 at 09:08 PM UTC
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza
v1.0.0-beta.1 - v1.2.0
v1.0.0-beta.1 - v1.2.0
Summary
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza
Details
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 hour ago
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza
v3.0.0 - v3.8.0 GO-2026-6668
v3.0.0 - v3.8.0 GO-2026-6668
Unknown
1 hour ago
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza
v3.0.0 - v3.8.0 GO-2026-6668
v3.0.0 - v3.8.0 GO-2026-6668
Unknown
1 hour ago
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza
v3.0.0 - v3.8.0 GO-2026-6668
v3.0.0 - v3.8.0 GO-2026-6668
Unknown
5 hours ago
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza
v2.0.0-alpha.1 - v2.0.1 GO-2026-6691
v2.0.0-alpha.1 - v2.0.1 GO-2026-6691
Unknown
5 hours ago
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza
v2.0.0-alpha.1 - v2.0.1 GO-2026-6691
v2.0.0-alpha.1 - v2.0.1 GO-2026-6691
Impacted packages
Timeline
Published
5 hours ago
October 19, 2026 at 09:08 PM UTC
Fixed (v3.8.0)
20 days ago
September 30, 2026 at 12:26 AM UTC
Last Modified
4 hours ago
October 19, 2026 at 09:40 PM UTC