OWASP Coraza WAF EUVD-2026-95926

Exploitation requires response-body inspection to be enabled (SecResponseBodyAccess On) with application/json among the inspected SecResponseBodyMimeType values, and a backend whose JSON response structure/nesting depth can be shaped by attacker input (e.g. echo or validation-error endpoints, GraphQL responses mirroring query nesting, or store-and-retrieve JSON blob APIs). The malicious nested payload must fit within the default 512 KiB ResponseBodyLimit (~87,000 nesting levels suffices for ~12s/core). Limiting factors: the request JSON path is NOT affected (it uses the configured recursion limit, default 1024), so only response processing is vulnerable; deployments with response-body access disabled, non-JSON responses, or backends that cannot be coerced into deep nesting are not exploitable; and CVSS AC:H reflects the indirect, backend-mediated nature of the trigger.

This is a moderate-severity availability-only flaw (CWE-674, uncontrolled recursion) best characterized as a CPU-exhaustion denial-of-service, not a confidentiality or integrity issue. The provided CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) is internally consistent and credible: network-reachable and unauthenticated (PR:N) but with high attack complexity (AC:H) because the attacker cannot hit the vulnerable code path directly - they must induce the protected backend to emit deeply nested JSON that Coraza then inspects. Impact is bounded to availability (A:H) with no data exposure. A proof-of-concept Go test is published inside the GHSA advisory with measured timings (~12s/core for a 512 KiB response at ~87,000 nesting levels), so publicly available exploit code exists; however, this is NOT confirmed active exploitation - there is no CISA KEV listing in the input and no EPSS score was provided, so the real-world exploitation-probability signal is MISSING and cannot be compared against the POC signal. No SSVC decision data was supplied. Net assessment: a legitimate, patch-worthy DoS for exposed Coraza deployments with response-body JSON inspection enabled, but it is materially gated by configuration and by whether a backend's JSON response nesting is attacker-influenceable - closer to a 'real but conditional' issue than a drop-everything emergency. Note the 'Information Disclosure' input tag conflicts with the actual availability-only impact and appears mislabeled.

An attacker repeatedly sends requests to an application fronted by Coraza (with SecResponseBodyAccess On and application/json in the inspected MIME types) that cause the backend to return deeply nested JSON - for example an echo/validation endpoint, a store-and-retrieve JSON blob API, or a GraphQL response whose nesting mirrors the attacker's query. Each ~512 KiB nested response forces the response-body processor into unbounded O(depth²) recursion, pinning one CPU core for roughly 12 seconds; a stream of such requests exhausts CPU and degrades or denies service. A working proof-of-concept test with measured timings is published in the GHSA-3c6w-j9xm-8h2h advisory.