Is CVE-2026-107833 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107833 being exploited in the wild.

How severe is CVE-2026-107833?

Medium severity, with a CVSS score of 5.9, published 9 October 2026.

Which products and versions are affected?

github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) SEMVER:introduced=3.0.0,fixed=3.8.0; OWASP Coraza 3.0.0 to 3.7.0.

How is CVE-2026-107833 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107833?

Check whether you run github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go), github.com/corazawaf/coraza/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107833: OWASP Coraza WAF denial of service in JSON response parsing

CVE-2026-107833 · Severity: medium · CVSS 5.9 · Published 2026-10-09

OWASP Coraza is a web application firewall library that inspects HTTP traffic. A flaw in response body JSON processing allows an attacker to craft deeply nested JSON responses that force excessive CPU consumption, potentially holding a server core busy for seconds and creating a denial-of-service condition. The vulnerability only affects deployments with response body inspection enabled.

Technologies: github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go), github.com/corazawaf/coraza/v3 (Go). Vendors: Go, OWASP.

Quick answers

Is CVE-2026-107833 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107833 being exploited in the wild.
How severe is CVE-2026-107833?: Medium severity, with a CVSS score of 5.9, published 9 October 2026.
Which products and versions are affected?: github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) SEMVER:introduced=3.0.0,fixed=3.8.0; OWASP Coraza 3.0.0 to 3.7.0.
Is there a fix for CVE-2026-107833?: Yes. github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.0 or later. Until then: Disable response body inspection (SecResponseBodyAccess Off) until upgrading, or reduce the ResponseBodyLimit configuration to minimize the impact window of deeply nested responses. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107833 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107833?: Check whether you run github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go), github.com/corazawaf/coraza/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.0 or later
```
go get github.com/corazawaf/coraza/v3@v3.8.0
```

Disable response body inspection (SecResponseBodyAccess Off) until upgrading, or reduce the ResponseBodyLimit configuration to minimize the impact window of deeply nested responses.

Technical details

The ProcessResponse function in internal/bodyprocessors/json.go passes a recursion limit of -1 to readJSON, but the recursion guard only triggers at exactly zero, so the limit is never enforced. An attacker can send a response with deeply nested JSON (O(depth²) parsing complexity) to cause quadratic work and exhaust CPU resources. Request-side JSON processing is not affected because it uses the configured recursion limit properly.

Affected products

OWASP Coraza 3.0.0 to 3.7.0

Identifiers

CVE-2026-107833
GHSA-3c6w-j9xm-8h2h
GO-2026-6690

Timeline

2026-10-09: disclosed
2026-09-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.