CVE-2026-107835 OWASP Coraza WAF: Cookie Parser Confusion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An...

CVE-2026-107835

The OWASP Coraza WAF library (prior to version 3.8.1 ) contains a Cookie Parser Confusion vulnerability in the internal/cookies.ParseCookies function within internal/cookies/cookies.go. The root cause is that the library handles boundary ASCII control characters and control-only or empty cookie n...