CVE-2026-114100: Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGSPOST and REQUESTBODY empty, evading body rules while the backend still processes the payload.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using Coraza versions from 3.0.4 before 3.8.1 are affected when they inspect URL-encoded request bodies with rules that depend on ARGS_POST or REQUEST_BODY. The backend must accept and process application/x-www-form-urlencoded bodies with media-type parameters.
What does an attacker need to exploit it?
An attacker needs only network access to send an HTTP request; no authentication or user interaction is required. They can add a parameter such as charset=UTF-8 to the Content-Type value so Coraza does not select the URL-encoded body processor while the backend still processes the payload.
Are default body-inspection rules sufficient to detect the malicious payload?
No, body rules relying on ARGS_POST or REQUEST_BODY can be evaded because those variables remain empty for the crafted request. Rules inspecting other request attributes are not described as affected.
What is the remediation?
Upgrade Coraza to version 3.8.1 or later. The affected range is 3.0.4 through versions before 3.8.1.