{"action":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.","affected":[{"fixed":"3.8.1","introduced":"0"}],"component":"github.com/corazawaf/coraza/v3","cve_ids":["CVE-2026-114101"],"ecosystem":"Go","exploited":false,"fixed_versions":["3.8.1"],"ghsa_id":"GHSA-3wr7-993q-jrff","id":"tcs_01M5JK9JJ88TYND6D2DJ2BH630","modified_at":"2026-10-21T10:57:00.041974308Z","published_at":"2026-10-08T17:51:36Z","references":["https://osv.dev/vulnerability/GHSA-3wr7-993q-jrff","https://github.com/corazawaf/coraza/security/advisories/GHSA-3wr7-993q-jrff","https://github.com/corazawaf/coraza/commit/5427c501b2fea6ae1305903efef01b3049224a58","https://github.com/corazawaf/coraza/commit/b2a9264437116bdd98a86fe345b2aec1152d3d7c","https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a","https://github.com/corazawaf/coraza","https://github.com/corazawaf/coraza/releases/tag/v3.8.1"],"severity":{"label":"medium","score":4},"sources":[{"source":"osv","source_id":"GHSA-3wr7-993q-jrff","url":"https://osv.dev/vulnerability/GHSA-3wr7-993q-jrff"}],"summary":"Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules"}