OWASP Coraza WAF EUVD-2026-95930

Exploitation requires Coraza < 3.8.1 AND a protective SecRule scoped specifically to REQUEST_COOKIES or REQUEST_COOKIES_NAMES (a specific cookie name/value) AND a backend whose cookie parser trims boundary control characters differently from Coraza - confirmed divergent backends are PHP's $_COOKIE and Python's http.cookies (Node's cookie package and current Werkzeug 3.1.9 keep the name like Coraza, so bypass does not apply there). The attacker must place an ASCII control character (0x00-0x1F or 0x7F) directly adjacent to the '=' separator in the Cookie header. Limiting factors: the bypass only works for boundary-adjacent CTLs - interior CTLs (e.g. 'ab\vcd') are explicitly outside the advisory's remediation and are disputed among backends; success depends on knowing the backend parser's behavior and on the WAF ruleset actually keying on cookie names/values, which drives the High attack complexity. No authentication is required (PR:N per the CVSS vector).

This is a genuine but modest-severity WAF-bypass issue, not a high-urgency emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N, base 4.0 Medium) is internally consistent with the advisory: it is remotely reachable by an unauthenticated attacker (PR:N) but carries High attack complexity (AC:H) because success depends on the specific backend cookie parser and on a SecRule being scoped to a particular cookie name/value - a conditional, not a given. The Scope:Changed / Integrity:Low combination correctly reflects that the flaw in Coraza (the security-control component) causes impact on a different component (the protected backend application) by letting attacker-controlled cookie data slip past inspection; there is no confidentiality or availability impact, consistent with a detection-bypass rather than direct compromise. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active exploitation or weaponization - the signals point to a low-likelihood, defense-in-depth weakness rather than a mass-exploited vulnerability. One cross-signal nuance worth flagging: the input Tags label this 'Information Disclosure,' but the mechanism described (and CWE-436, Interpretation Conflict) is a parser-confusion WAF bypass, not disclosure of data to the attacker - the labeling overstates/mischaracterizes the impact class. Net priority: patch during normal maintenance, prioritizing deployments that rely on cookie-scoped SecRules in front of PHP or Python/http.cookies backends.

An attacker sends an HTTP request with a Cookie header containing an ASCII control character (e.g. a vertical tab) placed immediately next to the '=' separator, such as 'a\v=\t<payload>'. Coraza (< 3.8.1) indexes the cookie under a name/value that differs from what the backend application (e.g. PHP's $_COOKIE or Python's http.cookies) actually parses, so a SecRule scoped to that cookie name or value never matches, and the malicious cookie reaches the application uninspected. No public exploit code is identified at time of analysis, and the high attack complexity means the attacker must know or probe the backend's specific cookie-parsing behavior.