CVE-2026-107833

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains an unbounded recursion vulnerability in the ProcessResponse function located in internal/bodyprocessors/json.go. The root cause is that the ignoreJSONRecursionLimit value of -1 is passed to readJSON, while the recursive guard o...