CVE-2026-104774

Go/github.com/corazawaf/coraza CVE-2026-104774: medium 5.8

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6696
• nvd: CVE-2026-104774
• https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv
• https://github.com/corazawaf/coraza/commit/f9b7afdbcedce7ad814663eaee2e342578ea3bb2
• https://github.com/corazawaf/coraza/releases/tag/v3.8.0

CVE-2026-104774 · published 2026-10-19T21:08:17Z · modified 2026-10-19T21:31:52.276959358Z · JSON

Go/github.com/corazawaf/coraza/v3 CVE-2026-104774: medium 5.8

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

Action: Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.

go get github.com/corazawaf/coraza/v3@v3.8.0

Affected

Fixed versions

Sources

• osv: GHSA-pc5q-qfxp-ggqv
• https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv
• https://github.com/corazawaf/coraza/commit/f9b7afdbcedce7ad814663eaee2e342578ea3bb2
• https://github.com/corazawaf/coraza
• https://github.com/corazawaf/coraza/releases/tag/v3.8.0

CVE-2026-104774 · published 2026-10-08T17:45:53Z · modified 2026-10-19T21:40:49.940962982Z · JSON