{"id":"GO-2026-6698","summary":"Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza","details":"Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza","aliases":["CVE-2026-114100","GHSA-w253-m66g-rx24"],"modified":"2026-10-21T10:56:44.870639532Z","published":"2026-10-19T21:08:17Z","database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6698"},"references":[{"type":"ADVISORY","url":"https://github.com/corazawaf/coraza/security/advisories/GHSA-w253-m66g-rx24"},{"type":"FIX","url":"https://github.com/corazawaf/coraza/commit/3b6241ef895b089c66a59e51068a81cf40986e4d"},{"type":"FIX","url":"https://github.com/corazawaf/coraza/commit/a55950ffa161f33a29e14f87d926d7df3b85cc74"},{"type":"FIX","url":"https://github.com/corazawaf/coraza/commit/dd100261cf1d2e2b053803a50c9db28dcaaa4b7c"},{"type":"WEB","url":"https://github.com/corazawaf/coraza/releases/tag/v3.8.1"}],"affected":[{"package":{"name":"github.com/corazawaf/coraza","ecosystem":"Go","purl":"pkg:golang/github.com/corazawaf/coraza"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6698.json"}},{"package":{"name":"github.com/corazawaf/coraza/v2","ecosystem":"Go","purl":"pkg:golang/github.com/corazawaf/coraza/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6698.json"}},{"package":{"name":"github.com/corazawaf/coraza/v3","ecosystem":"Go","purl":"pkg:golang/github.com/corazawaf/coraza/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.4"},{"fixed":"3.8.1"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6698.json"}}],"schema_version":"1.9.0"}