CVE-2026-114100 Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114100?
CVE-2026-114100 is a medium-severity vulnerability in corazawaf coraza, published on 21 Oct 2026.
Official description
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.
Weakness: CWE-20
Which versions are affected by CVE-2026-114100?
5 open source packages ship an affected version, including github.com/corazawaf/coraza/v3, github.com/corazawaf/coraza and github.com/corazawaf/coraza/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/corazawaf/coraza/v3 Go | From 3.0.4 | 3.8.1 |
github.com/corazawaf/coraza/v3 Go | From 3.0.4 | 3.8.1 |
github.com/corazawaf/coraza/v3 Go | From 3.0.4 | 3.8.1 |
github.com/corazawaf/coraza Go | All versions | None |
github.com/corazawaf/coraza/v2 Go | All versions | None |
How do I fix CVE-2026-114100?
Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.
Is CVE-2026-114100 being exploited?
There is no known exploitation of CVE-2026-114100 in the wild and no public exploit code.
Sources
Also known as GHSA-5846-6v99-476c, GHSA-w253-m66g-rx24, GO-2026-6698.