CVE-2026-41510

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains a flaw where request arguments are silently dropped once the SecArgumentsLimit (default 1000) is reached. Because the engine fails to set an error flag or notify rules, an unauthenticated attacker can bypass security rules targ...

CVE-2026-41510 OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGSPOST without enforcing the cap. The fl...