{"items":[{"id":"NVI-00012034","kind":"vulnerability","title":"Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-w253-m66g-rx24"],"plain_summary":"GitHub lists this reviewed advisory for github.com/corazawaf/coraza/v3. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9036fcf43b712f09b941e2082d5b2d17"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-08T17:51:54.000Z","value":"5.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-9036fcf43b712f09b941e2082d5b2d17"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9036fcf43b712f09b941e2082d5b2d17","url":"https://github.com/advisories/GHSA-w253-m66g-rx24","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w253-m66g-rx24","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:23.763Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9036fcf43b712f09b941e2082d5b2d17"],"technology":"github.com/corazawaf/coraza/v3","known_exclusions":[],"conditions_summary":"### Summary\n\nCoraza fails to inspect URL-encoded form bodies when their valid `Content-Type` contains a media-type parameter, for example:\n\n```http\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n```\n\nAn unauthenticated attacker can use this header to hide the complete form body from custom Coraza rules that inspect `ARGS_POST` or `REQUEST_BODY`, while the bundled Go HTTP middleware forwards the body and the backend parses it normally.\n\nThis is a deterministic request-body inspection bypass. Suggested severity: **Medium**. Current OWASP CRS includes rule `901340`, which forces fallback inspection and mitigates this path; this report does not claim a bypass of an unmodified current CRS ruleset\n\n### Details\n\nThe affected component is request-body processor selection in `internal/corazawaf/transaction.go`.\n\n`Transaction.AddRequestHeader` compares the complete lowercased header value using exact equality:\n\n```go\ncase \"content-type\":\n    val := strings.ToLower(value)\n    if val == \"application/x-www-form-urlencoded\" {\n        tx.variables.reqbod","public_affected_ranges":[">= 3.0.4, < 3.8.1"]}],"null_published_at":"2026-11-01T01:03:56.623Z","source_updated_at":"2026-10-08T17:51:54.000Z","source_disclosed_at":"2026-10-08T17:51:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:23.763Z"}],"next_cursor":null,"snapshot_revision":"42594"}