CVE-2026-114099: Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Coraza versions from 3.0.0 up to, but not including, 3.8.1 are affected when they inspect JSON request bodies with the JSON body processor. The issue is relevant where OWASP CRS rules are relied on to detect SQL injection in JSON parameters.
What does an attacker need to exploit this?
An attacker needs only network access to send a crafted JSON request; no authentication or user interaction is required. The request must contain colliding nested and literal dotted JSON property names so that a later dotted property overwrites the value inspected by the WAF.
Are backends protected by the WAF from the hidden value?
No. The WAF's flattened ARGS_POST representation can be overwritten by the colliding property, while the backend still receives the malicious nested value. This can allow SQL injection payloads to evade OWASP CRS inspection.
What should be done if upgrading cannot happen immediately?
The provided data does not specify a workaround. Prioritize upgrading to 3.8.1 or later, and avoid relying solely on Coraza's JSON inspection for SQL injection protection until the affected version is replaced.