CVE-2026-107835: OWASP Coraza WAF: Cookie Parser Confusion
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUESTCOOKIES or REQUESTCOOKIESNAMES to miss application-visible attacker data. Exploitation depends on the backend parser and affected rule scope, and interior control characters with inconsistent backend behavior are outside this advisory's remediation. This issue is fixed in version 3.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OWASP Coraza WAFto a version that resolves this vulnerability.Fixed in 3.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using OWASP Coraza WAF before version 3.8.1 may be exposed when their backend application's cookie parser handles boundary ASCII control characters or control-only or empty cookie names differently from Coraza. Impact also depends on whether rules inspect REQUEST_COOKIES or REQUEST_COOKIES_NAMES.
What does an attacker need to exploit it?
An unauthenticated attacker only needs to send a crafted Cookie header. The header must trigger a parsing difference such that Coraza indexes or drops cookie data under a different name or value than the backend application sees.
What should be done if patching cannot happen immediately?
The provided data identifies version 3.8.1 as the fix but does not specify a workaround. Prioritize reviewing rules that rely on REQUEST_COOKIES or REQUEST_COOKIES_NAMES and the backend parser behavior for malformed cookie names and boundary ASCII control characters.
Does the fix cover all control-character cookie parsing differences?
No. The advisory states that interior control characters with inconsistent backend behavior are outside its remediation.