ETK-2026-387Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-387",
  "cve_id": null,
  "display_id": "ETK-2026-387",
  "ghsa_id": null,
  "euvd_id": null,
  "status": "retired",
  "anchor_state": "awaiting_cve",
  "title": "Stack-exhaustion denial of service in Coraza JSON processing",
  "summary": "Coraza versions before 3.8.1 can terminate their host process while handling certain deeply nested JSON bodies. An unauthenticated remote attacker can trigger the condition by sending JSON to an endpoint where Coraza's JSON body processor is enabled, which is normally selected for application/json requests.",
  "mitigation": "Upgrade github.com/corazawaf/coraza/v3 to version 3.8.1 or later. Until upgraded, restrict untrusted JSON requests or disable JSON body processing where operationally feasible.",
  "vendor": "go",
  "product": "go:github.com/corazawaf/coraza/v3",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, < 3.8.1"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "3.8.1"
      ],
      "package_name": "github.com/corazawaf/coraza/v3",
      "purl": "pkg:golang/github.com/corazawaf/coraza/v3"
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": null,
  "signals": {}
}