{"id":"EUVD-2026-97826","enisaUuid":"73a0c460-43cf-39f1-bd0a-85d41fcaf2e3","description":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.","datePublished":"Oct 12, 2026, 7:59:45 PM","dateUpdated":"Oct 13, 2026, 5:26:41 PM","baseScore":5.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-prpw-wwv7-xjjr\nhttps://github.com/corazawaf/coraza/commit/a3079325547c7c1e08522aed4d6468f25d080e25\nhttps://github.com/corazawaf/coraza/releases/tag/v3.8.0\n","aliases":"CVE-2026-41504\nGHSA-prpw-wwv7-xjjr\n","assigner":"GitHub_M","epss":0.36,"enisaIdProduct":[{"id":"e537a7fa-b1a7-39fb-a07a-be18362bf065","product":{"name":"coraza","vendor":{"name":"corazawaf"}},"product_version":"3.0.0, \u003c 3.8.0"}],"enisaIdVendor":[{"id":"534d0561-fc4c-33a9-b556-03a2514de24b","vendor":{"name":"corazawaf"}}],"enisaIdVulnerability":[{"id":"4a82f8d4-be28-3289-9c1a-1102f64cf079","vulnerability":{"id":"GHSA-prpw-wwv7-xjjr","description":"Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields","datePublished":"Oct 6, 2026, 8:37:27 PM","dateUpdated":"Oct 6, 2026, 8:37:27 PM","baseScore":0.0,"references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-prpw-wwv7-xjjr\nhttps://github.com/corazawaf/coraza/commit/a3079325547c7c1e08522aed4d6468f25d080e25\nhttps://github.com/corazawaf/coraza\nhttps://github.com/corazawaf/coraza/releases/tag/v3.8.0\n","enisa_id":"EUVD-2026-97826\n","aliases":"CVE-2026-41504\nGHSA-prpw-wwv7-xjjr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ce9cdb7e-7c50-3995-a1e5-1a415f6e1a2a","vulnerability":{"id":"CVE-2026-41504","description":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.","datePublished":"Oct 12, 2026, 7:59:45 PM","dateUpdated":"Oct 13, 2026, 5:26:41 PM","status":"PUBLISHED","baseScore":5.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-prpw-wwv7-xjjr\nhttps://github.com/corazawaf/coraza/commit/a3079325547c7c1e08522aed4d6468f25d080e25\nhttps://github.com/corazawaf/coraza/releases/tag/v3.8.0\n","enisa_id":"EUVD-2026-97826\n","assigner":"GitHub_M","epss":0.36,"dataProcessed":"Nov 7, 2026, 7:21:17 AM","vulnerabilityProduct":[{"id":"8f9fd80f-dbf4-314c-a6a5-325f69d74d76","product":{"name":"coraza","vendor":{"name":"corazawaf"}},"product_version":"3.0.0, \u003c 3.8.0"}],"vulnerabilityVendor":[{"id":"fe6dac86-f3eb-302e-badd-def1ea0ab140","vendor":{"name":"corazawaf"}}]}}],"enisaIdAdvisory":[]}