CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2023-40586
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- coraza:coraza
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c2pj-v37r-2p6h | Go | github.com/corazawaf/coraza/v3 | >=3.0.0 <3.0.1 | 3.0.1 |
| GHSA-c2pj-v37r-2p6h | Go | github.com/corazawaf/coraza/v2 | >=2.0.0 <=2.0.1 | no fix published |
| GO-2023-1874 | Go | github.com/corazawaf/coraza/v2 | all versions | no fix published |
| GO-2023-1874 | Go | github.com/corazawaf/coraza/v3 | <3.0.1 | 3.0.1 |
References
- https://github.com/corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcade8c
- https://github.com/corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6h
- https://github.com/corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcade8c
- https://github.com/corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6h