CVE-2026-107835

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions prior to 3.8.1

Description The internal/cookies.ParseCookies function in internal/cookies/cookies.go fails to properly strip ASCII control characters (CTLs) from the edges of cookie names and values. This creates a parser discrepancy where Coraza may index or drop a cookie under a different name or value than the backend application. An unauthenticated attacker can exploit this by crafting a Cookie header with CTLs adjacent to the = separator, causing security rules targeting REQUEST COOKIES or REQUEST COOKIES NAMES to miss malicious data that the backend application still processes. This results in a WAF bypass for cookie-carried attacks.

Recommendations Update OWASP Coraza WAF to version 3.8.1 or later.