{"id":"EUVD-2026-106902","enisaUuid":"95e6c7da-068a-371e-bca4-39e5ee520caa","description":"Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.","datePublished":"Oct 21, 2026, 12:37:01 AM","dateUpdated":"Oct 28, 2026, 4:12:46 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-5gj4-9gm7-2fx2\nhttps://www.vulncheck.com/advisories/coraza-3.0.0-before-3.8.1-waf-bypass-via-json-key-collision\n","aliases":"CVE-2026-114099\nGHSA-vmwg-gmpq-826x\n","assigner":"VulnCheck","epss":0.2,"enisaIdProduct":[{"id":"e4a35ec2-26e0-3326-9acf-10e1b55a14db","product":{"name":"coraza","vendor":{"name":"corazawaf"}},"product_version":"3.0.0 \u003c3.8.1"}],"enisaIdVendor":[{"id":"0a140248-d37b-32f5-932b-6ec4646cc7c7","vendor":{"name":"corazawaf"}}],"enisaIdVulnerability":[{"id":"1324294a-c234-3f68-b9ba-fd5a8c13e2c4","vulnerability":{"id":"GHSA-vmwg-gmpq-826x","description":"Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.","datePublished":"Oct 21, 2026, 3:32:26 AM","dateUpdated":"Oct 21, 2026, 3:32:26 AM","baseScore":0.0,"references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-5gj4-9gm7-2fx2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114099\nhttps://www.vulncheck.com/advisories/coraza-3.0.0-before-3.8.1-waf-bypass-via-json-key-collision\n","enisa_id":"EUVD-2026-106902\n","aliases":"CVE-2026-114099\nGHSA-vmwg-gmpq-826x\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"74a5d9a9-1cbb-3300-835c-4358d036da40","vulnerability":{"id":"CVE-2026-114099","description":"Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.","datePublished":"Oct 21, 2026, 12:37:01 AM","dateUpdated":"Oct 28, 2026, 4:12:46 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-5gj4-9gm7-2fx2\nhttps://www.vulncheck.com/advisories/coraza-3.0.0-before-3.8.1-waf-bypass-via-json-key-collision\n","enisa_id":"EUVD-2026-106902\n","assigner":"VulnCheck","epss":0.2,"dataProcessed":"Oct 30, 2026, 3:00:58 AM","vulnerabilityProduct":[{"id":"cfb09194-05be-3ba9-809c-3c3be184850d","product":{"name":"coraza","vendor":{"name":"corazawaf"}},"product_version":"3.0.0 \u003c3.8.1"}],"vulnerabilityVendor":[{"id":"8edbeb99-b01a-3a39-b3aa-4a6b9263c178","vendor":{"name":"corazawaf"}}]}}],"enisaIdAdvisory":[]}