Moyenne
5.8
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body...
CVE-2026-114100
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Références
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com