CVE-2026-107833

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.0.0 through 3.7.x

Description An issue exists in the JSON response body processor where the ProcessResponse() function in internal/bodyprocessors/json.go fails to enforce a recursion limit. It passes a value of -1 to the readJSON() function, while the recursive guard in readItems() only triggers when the value equals zero. Consequently, counting down from -1 never reaches zero, rendering the guard ineffective.

A network attacker can exploit this by causing an application to return a deeply nested JSON response. This results in quadratic CPU work, where the processing cost grows relative to the nesting depth. For example, a 512 KiB response with approximately 87,000 nesting levels can occupy a single CPU core for about 12 seconds. This exploitation requires response-body inspection to be enabled and a backend that returns JSON content.

Recommendations Update to version 3.8.0. As a temporary mitigation, disable response-body inspection for JSON content until the update is applied.