{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/corazawaf/coraza","cve_ids":["CVE-2026-114101"],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-3wr7-993q-jrff","id":"tcs_01M5JK9K9GSH239SDV7CPTGMDV","modified_at":"2026-10-21T10:57:00.041974308Z","published_at":"2026-10-19T21:08:17Z","references":["https://osv.dev/vulnerability/GO-2026-6691","https://github.com/corazawaf/coraza/security/advisories/GHSA-3wr7-993q-jrff","https://github.com/corazawaf/coraza/commit/5427c501b2fea6ae1305903efef01b3049224a58","https://github.com/corazawaf/coraza/commit/b2a9264437116bdd98a86fe345b2aec1152d3d7c","https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a","https://github.com/corazawaf/coraza/releases/tag/v3.8.1"],"severity":{"label":"medium","score":4},"sources":[{"source":"osv","source_id":"GO-2026-6691","url":"https://osv.dev/vulnerability/GO-2026-6691"},{"source":"nvd","source_id":"CVE-2026-114101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114101"}],"summary":"Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza"}