GHSA-6R3Q-MJV7-XR8M Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

Root Cause File: internal/corazawaf/transaction.go, lines 770–808 since commit 2fd87b89, PR 812, 2023-06-14 go func tx Transaction AddGetRequestArgumentkey string, value string if tx.checkArgumentLimittx.variables.argsGet tx.debugLogger.Warn.Msg"skipping get request argument, over limit" return...

PT-2026-107377

Name of the Vulnerable Software and Affected Versions Coraza versions 3.0.0 through 3.8.0 Description Coraza contains a flaw where request arguments are silently discarded once the SecArgumentsLimit default 1000 is reached. Because the engine does not set an error flag or notify rules when this...