CVE-2026-107826

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.0.0 through 3.8.0

Description An unauthenticated attacker can cause the hosting process to terminate with an unrecoverable fatal stack overflow. This occurs because the readJSON function in internal/bodyprocessors/json.go may stop its bounded flattening walk after reaching the SecArgumentsLimit or the byte budget, subsequently calling gjson.Valid on the complete raw body. If the body contains shallow values followed by an extremely deeply nested JSON tail that was not visited during the bounded walk, gjson.Valid recurses without a depth bound, leading to the crash. This issue affects both the ProcessRequest and ProcessResponse JSON paths and can be triggered even when the payload remains within recommended body-size and argument-count limits.

Recommendations Update OWASP Coraza WAF to version 3.8.1.