go package github.com/corazawaf/coraza is vulnerable to denial of service

Also known as GHSA-c2pj-v37r-2p6h, GO-2023-1874

Published 3 y ago 2023-06-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.7%

percentile 54%

Public exploits

none known

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: yes
Technical impact: partial
Assessed: 2 y ago 2024-10-02

Exploit prediction (EPSS)

0.72% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
GitHub	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/corazawaf/coraza/v3`	>=3.0.0, <3.0.1 <3.0.1	3.0.1
go	`github.com/corazawaf/coraza/v2`	>=2.0.0, <=2.0.1 all versions	no fix listed

Affected products

corazawaf coraza

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

github.com /corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6h · x_refsource_CONFIRM, x_transferred
github.com /corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcade8c · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2023-40586 · advisory
github.com /corazawaf/coraza-caddy/issues/48 · web
github.com /corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec · web
github.com /corazawaf/coraza/commit/e1b119b83e12c64f0957e00e8cad45a1b5f012f8 · web
github.com /corazawaf/coraza · package
github.com /corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/mu · web
github.com /corazawaf/coraza/releases/tag/v3.0.1 · web
github.com /golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291 · web

Sources

CVE List: CVE-2023-40586
GitHub Advisory: GHSA-c2pj-v37r-2p6h
NVD: CVE-2023-40586
OSV: GO-2023-1874

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary