Go/github.com/corazawaf/coraza/v3 CVE-2026-41504: medium 5.8

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

Action: Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.

go get github.com/corazawaf/coraza/v3@v3.8.0

Affected

Fixed versions

Sources

• osv: GHSA-prpw-wwv7-xjjr
• https://github.com/corazawaf/coraza/security/advisories/GHSA-prpw-wwv7-xjjr
• https://github.com/corazawaf/coraza/commit/a3079325547c7c1e08522aed4d6468f25d080e25
• https://github.com/corazawaf/coraza
• https://github.com/corazawaf/coraza/releases/tag/v3.8.0

CVE-2026-41504 · published 2026-10-06T20:37:27Z · modified 2026-10-20T00:40:33.971199199Z · JSON