{"id":"EUVD-2026-106903","enisaUuid":"1de6070a-789b-3e32-982e-f28583994509","description":"Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset\u003dUTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.","datePublished":"Oct 21, 2026, 12:37:02 AM","dateUpdated":"Oct 21, 2026, 3:49:38 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-w253-m66g-rx24\nhttps://www.vulncheck.com/advisories/coraza-from-3.0.4-before-3.8.1-request-body-inspection-bypass-via-content-type\n","aliases":"CVE-2026-114100\nGHSA-5846-6v99-476c\n","assigner":"VulnCheck","epss":0.28,"enisaIdProduct":[{"id":"19a0f0bd-be7e-3015-b716-415c4458c954","product":{"name":"coraza","vendor":{"name":"corazawaf"}},"product_version":"3.0.4 \u003c3.8.1"}],"enisaIdVendor":[{"id":"523cf5b8-5a4f-32f0-9798-0dc3aca0f851","vendor":{"name":"corazawaf"}}],"enisaIdVulnerability":[{"id":"1c75aff7-554c-3375-b5e8-825489c963a6","vulnerability":{"id":"GHSA-5846-6v99-476c","description":"Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset\u003dUTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.","datePublished":"Oct 21, 2026, 3:32:26 AM","dateUpdated":"Oct 21, 2026, 3:32:26 AM","baseScore":0.0,"references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-w253-m66g-rx24\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114100\nhttps://www.vulncheck.com/advisories/coraza-from-3.0.4-before-3.8.1-request-body-inspection-bypass-via-content-type\n","enisa_id":"EUVD-2026-106903\n","aliases":"GHSA-5846-6v99-476c\nCVE-2026-114100\n","epss":0.0,"dataProcessed":"Nov 4, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"87e982f5-b8d3-3545-a0e2-745cb968acd6","vulnerability":{"id":"CVE-2026-114100","description":"Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset\u003dUTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.","datePublished":"Oct 21, 2026, 12:37:02 AM","dateUpdated":"Oct 21, 2026, 3:49:38 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-w253-m66g-rx24\nhttps://www.vulncheck.com/advisories/coraza-from-3.0.4-before-3.8.1-request-body-inspection-bypass-via-content-type\n","enisa_id":"EUVD-2026-106903\n","assigner":"VulnCheck","epss":0.28,"dataProcessed":"Nov 4, 2026, 7:14:08 AM","vulnerabilityProduct":[{"id":"f27163df-faef-3bd8-9e80-1dc512277e1d","product":{"name":"coraza","vendor":{"name":"corazawaf"}},"product_version":"3.0.4 \u003c3.8.1"}],"vulnerabilityVendor":[{"id":"6725c3f7-c5ad-3963-9168-a2d0dc241b10","vendor":{"name":"corazawaf"}}]}}],"enisaIdAdvisory":[]}