# CVE-2026-107833: OWASP Coraza WAF denial of service in JSON response parsing

Source: https://junglewise.ai/threats/cve-2026-107833-coraza-unbounded-recursion-in-json-response-body-processor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107833 · Severity: medium · CVSS 5.9 · Published 2026-10-09

OWASP Coraza is a web application firewall library that inspects HTTP traffic. A flaw in response body JSON processing allows an attacker to craft deeply nested JSON responses that force excessive CPU consumption, potentially holding a server core busy for seconds and creating a denial-of-service condition. The vulnerability only affects deployments with response body inspection enabled.

Technologies: [github.com/corazawaf/coraza (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza), [github.com/corazawaf/coraza/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza-v2), [github.com/corazawaf/coraza/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza-v3). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OWASP](https://junglewise.ai/threats/vendors/owasp).

## Quick answers

**Is CVE-2026-107833 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107833 being exploited in the wild.

**How severe is CVE-2026-107833?** Medium severity, with a CVSS score of 5.9, published 9 October 2026.

**Which products and versions are affected?** github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) SEMVER:introduced=3.0.0,fixed=3.8.0; OWASP Coraza 3.0.0 to 3.7.0.

**Is there a fix for CVE-2026-107833?** Yes. github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.0 or later. Until then: Disable response body inspection (SecResponseBodyAccess Off) until upgrading, or reduce the ResponseBodyLimit configuration to minimize the impact window of deeply nested responses. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107833 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107833?** Check whether you run github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go), github.com/corazawaf/coraza/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.0 or later

  ```sh
  go get github.com/corazawaf/coraza/v3@v3.8.0
  ```


Disable response body inspection (SecResponseBodyAccess Off) until upgrading, or reduce the ResponseBodyLimit configuration to minimize the impact window of deeply nested responses.

## Technical details

The ProcessResponse function in internal/bodyprocessors/json.go passes a recursion limit of -1 to readJSON, but the recursion guard only triggers at exactly zero, so the limit is never enforced. An attacker can send a response with deeply nested JSON (O(depth²) parsing complexity) to cause quadratic work and exhaust CPU resources. Request-side JSON processing is not affected because it uses the configured recursion limit properly.

## Affected products

- OWASP Coraza 3.0.0 to 3.7.0

## Identifiers

- CVE-2026-107833
- GHSA-3c6w-j9xm-8h2h
- GO-2026-6690

## Timeline

- 2026-10-09: disclosed
- 2026-09-30: patched

## References

- [https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a](https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a)
- [https://github.com/corazawaf/coraza/releases/tag/v3.8.0](https://github.com/corazawaf/coraza/releases/tag/v3.8.0)

## Related threats

- [Coraza multipart filename rule bypass via RFC 5987 charset handling](https://junglewise.ai/threats/cve-2026-114101-coraza-before-3-8-1-extracts-multipart-upload-filenames-with-go)
- [Coraza request body inspection bypass in Content-Type parsing](https://junglewise.ai/threats/cve-2026-114100-coraza-from-3-0-4-before-3-8-1-contains-a-request-body)
- [Coraza JSON body processor key collision WAF bypass](https://junglewise.ai/threats/cve-2026-114099-coraza-from-3-0-0-before-3-8-1-has-a-json-body-processor-that)
- [Coraza multipart strict validation bypass via truncated body](https://junglewise.ai/threats/cve-2026-41508-coraza-truncated-multipart-body-bypasses-multipart-strict-error)
- [Coraza CRLF injection in Native audit-log format](https://junglewise.ai/threats/cve-2026-41504-coraza-native-audit-log-format-allows-crlf-injection-and-log)