GO-2026-6690 Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza...

PT-2026-118012

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

GHSA-3C6W-J9XM-8H2H Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Summary The JSON response body processor parses response bodies with no recursion limit. ProcessResponse calls readJSONss, ignoreJSONRecursionLimit, and that constant is -1. The guard in readItems only fires on == 0, so counting down from -1 -2, -3, ... never reaches it. The guard is effectively...

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Summary The JSON response body processor parses response bodies with no recursion limit. ProcessResponse calls readJSONss, ignoreJSONRecursionLimit, and that constant is -1. The guard in readItems only fires on == 0, so counting down from -1 -2, -3, ... never reaches it. The guard is effectively...