CVE-2026-114100

CVSS 6.9 (medium) · published 2026-10-21

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.

Weakness: CWE-20

Source: NVD CVE-2026-114100

References

• https://github.com/corazawaf/coraza/security/advisories/GHSA-w253-m66g-rx24
• https://www.vulncheck.com/advisories/coraza-from-3.0.4-before-3.8.1-request-body-inspection-bypass-via-content-type

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.