Go/github.com/corazawaf/coraza/v2 CVE-2026-107835: medium 4, EPSS 0.30%

Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6694#Go/github.com/corazawaf/coraza/v2
• nvd: CVE-2026-107835
• https://github.com/corazawaf/coraza/security/advisories/GHSA-g4qm-m288-5cp9
• https://github.com/corazawaf/coraza/commit/0b940e197ad9983fb3aa36e84f1f81ff985461af
• https://github.com/corazawaf/coraza/commit/9f8521398d1ff023b958fad0b944cac265763866
• https://github.com/corazawaf/coraza/releases/tag/v3.8.1

CVE-2026-107835 · published 2026-10-19T21:08:17Z · modified 2026-10-19T21:40:49.823376643Z · JSON