{"id":"GO-2026-6698","revision":"4067e51bea074b35a54ea9af0b077cf2","records":[{"revision":"4067e51bea074b35a54ea9af0b077cf2","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6698","aliases":["CVE-2026-114100","GHSA-w253-m66g-rx24"],"title":"Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza","description":"Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza","state":0,"publishedAt":"2026-10-19T21:08:17+00:00","modifiedAt":"2026-10-21T10:56:44.8706395+00:00","affected":[{"ecosystem":"Go","name":"github.com/corazawaf/coraza","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/corazawaf/coraza/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/corazawaf/coraza/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.4"},{"kind":"fixed","version":"3.8.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/corazawaf/coraza/security/advisories/GHSA-w253-m66g-rx24","https://github.com/corazawaf/coraza/commit/3b6241ef895b089c66a59e51068a81cf40986e4d","https://github.com/corazawaf/coraza/commit/a55950ffa161f33a29e14f87d926d7df3b85cc74","https://github.com/corazawaf/coraza/commit/dd100261cf1d2e2b053803a50c9db28dcaaa4b7c","https://github.com/corazawaf/coraza/releases/tag/v3.8.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6698","license":"OSV · upstream source license applies","key":"osv:GO-2026-6698","identifiers":["GO-2026-6698","CVE-2026-114100","GHSA-w253-m66g-rx24"]},"retained":false,"historicalAffected":[]}],"coverage":[]}