CVE-2026-107825

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains a vulnerability in the ProcessURI function located in internal/corazawaf/transaction.go. When url.ParseRequestURI fails, the system retains the raw URI but leaves variables like QUERY_STRING and ARGS_GET empty. An unauthenticat...