OWASP Coraza WAF CVE-2026-107826

Requires that the target application routes request (ProcessRequest) or response (ProcessResponse) bodies through Coraza's JSON body processor - i.e. JSON content is parsed, which is the default behavior for application/json bodies in affected versions 3.0.0-3.8.0. No authentication, no user interaction, and no non-default tuning are needed; the attack works WITHIN default SecArgumentsLimit (1000) and under the recommended SecRequestBodyLimit, so default configurations are vulnerable. The only real limiting factors are that Coraza must be inline and configured to inspect JSON bodies, and the attacker must be able to deliver a body large enough to carry the deeply nested tail (the documented repro is ~13 MB); the SecRequestBodyJsonDepthLimit/SecResponseBodyJsonDepthLimit (default 1024) does not prevent it because the nested tail is never visited by the bounded walk before gjson.Valid runs on the raw body.

All signals point to a genuine but availability-only (DoS) issue. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) describes remote, unauthenticated, low-complexity exploitation with no user interaction and no scope change, and impact confined entirely to availability (C:N/I:N/A:H) - consistent with CWE-674 (uncontrolled recursion) producing a fatal, unrecoverable stack overflow that terminates the host process. There is no RCE or data-exposure dimension, so this is not a confidentiality/integrity emergency, but because Coraza runs inline as a WAF, a single crafted request can crash the protected application process and simultaneously remove WAF coverage, making it a meaningful operational-availability priority rather than a purely theoretical high-CVSS issue. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is indicated in the input, so exploitation status is 'no public exploit identified at time of analysis'; however, the GHSA advisory documents an exact reproduction recipe (1000 shallow scalars to exhaust SecArgumentsLimit followed by ~13,000,000 nested '[' characters in a ~13 MB body), which substantially lowers the barrier to weaponization despite the absence of published exploit code. Net assessment: patch promptly for any Coraza deployment processing JSON bodies, but treat as a DoS/availability risk, not a compromise risk.

An unauthenticated attacker sends a single crafted JSON request (or triggers a crafted JSON response) to any endpoint fronted by Coraza with the JSON body processor active. The body stays under the recommended SecRequestBodyLimit and default SecArgumentsLimit, using 1000 shallow scalars to stop the bounded flattening walk early, then a deeply nested tail that reaches the unbounded gjson.Valid call and crashes the entire host process with an uncatchable fatal stack overflow. No public exploit code is identified, but the GHSA advisory documents a precise reproduction recipe, so the attack is effectively trivial to reproduce.