CVE-2026-107826

{
  "etk_id": "ETK-2026-1109",
  "cve_id": "CVE-2026-107826",
  "display_id": "CVE-2026-107826",
  "ghsa_id": "GHSA-6gcq-wc29-5xf2",
  "euvd_id": "EUVD-2026-95925",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stack overflow denial of service in Coraza JSON processing",
  "summary": "Coraza versions before 3.8.1 can terminate the hosting process when processing specially structured JSON request or response bodies. An unauthenticated attacker needs to send JSON to an endpoint where Coraza's JSON body processor is enabled; the resulting process crash disrupts in-flight traffic.",
  "mitigation": "Upgrade the coraza package to version 3.8.1 or later. Until upgrading, reduce exposure by disabling JSON body processing where it is not required and restricting untrusted JSON-bearing requests.",
  "vendor": "corazawaf",
  "product": "coraza",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, < 3.8.1"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "3.8.1"
      ],
      "package_name": "github.com/corazawaf/coraza/v3",
      "purl": "pkg:golang/github.com/corazawaf/coraza/v3"
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0046,
  "epss_percentile": 0.3866,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 15.562682466666667,
  "t0_at": "2026-10-09T17:33:49.389000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-09T03:27:25.229037+00:00",
      "days": -0.5877796292013889,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T17:33:49.389000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-02T13:55:35+00:00",
      "days": -7.151555428240741,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T17:33:49.389000+00:00",
      "url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2"
    },
    "trigger_signal": {
      "at": "2026-10-02T13:55:35+00:00",
      "days": -7.151555428240741,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T17:33:49.389000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107826"
    }
  }
}