# CVE-2026-41504: Coraza CRLF injection in Native audit-log format

Source: https://junglewise.ai/threats/cve-2026-41504-coraza-native-audit-log-format-allows-crlf-injection-and-log  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-41504 · Severity: medium · CVSS 5.8 · Published 2026-10-12

Coraza is a web application firewall that logs security events to audit files. When configured to use the Native audit-log format (the default), attackers can inject newline characters into request bodies and headers, allowing them to forge fake log entries that appear identical to genuine security alerts. This enables attackers to hide attacks, shift blame to other IP addresses, or confuse security monitoring systems.

Technologies: [Coraza](https://junglewise.ai/threats/technologies/coraza-coraza), [github.com/corazawaf/coraza (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza), [github.com/corazawaf/coraza/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza-v2), [github.com/corazawaf/coraza/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza-v3). Vendors: [Coraza](https://junglewise.ai/threats/vendors/coraza), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-41504 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41504 being exploited in the wild.

**How severe is CVE-2026-41504?** Medium severity, with a CVSS score of 5.8, published 12 October 2026.

**Which products and versions are affected?** Coraza 3.0.0 through 3.7.0 when using SecAuditLogFormat Native; github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) >= 3.0.0, <= 3.7.0, SEMVER:introduced=3.0.0,fixed=3.8.0.

**Is there a fix for CVE-2026-41504?** Yes. github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.0 or later. Until then: Deployments using JSON or OCSF audit-log formats are unaffected. Alternatively, disable Native audit logging by switching to `SecAuditLogFormat JSON` or `SecAuditLogFormat OCSF`, or disable audit logging entirely with `SecAuditEngine Off`. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41504 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41504?** Check whether you run Coraza, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.0 or later

  ```sh
  go get github.com/corazawaf/coraza/v3@v3.8.0
  ```


Deployments using JSON or OCSF audit-log formats are unaffected. Alternatively, disable Native audit logging by switching to `SecAuditLogFormat JSON` or `SecAuditLogFormat OCSF`, or disable audit logging entirely with `SecAuditEngine Off`.

## Technical details

The Native audit-log formatter in `internal/auditlog/formats.go` writes attacker-controlled request bodies, headers, error messages, and rule data directly to the log stream without escaping carriage return (`\r`) or newline (`\n`) characters. The log format uses line-based structural delimiters, so injected newlines break the integrity of individual audit records. Exploitation requires ability to control request body (reachable via standard HTTP) or request headers (reachable in non-net/http integrations like HAProxy or Envoy); no authentication or user interaction required.

## Affected products

- Coraza Coraza 3.0.0 through 3.7.0 when using SecAuditLogFormat Native

## Identifiers

- CVE-2026-41504
- GHSA-prpw-wwv7-xjjr
- GO-2026-6669

## Timeline

- 2026-10-06: disclosed

## Related threats

- [Coraza multipart filename rule bypass via RFC 5987 charset handling](https://junglewise.ai/threats/cve-2026-114101-coraza-before-3-8-1-extracts-multipart-upload-filenames-with-go)
- [Coraza request body inspection bypass in Content-Type parsing](https://junglewise.ai/threats/cve-2026-114100-coraza-from-3-0-4-before-3-8-1-contains-a-request-body)
- [Coraza JSON body processor key collision WAF bypass](https://junglewise.ai/threats/cve-2026-114099-coraza-from-3-0-0-before-3-8-1-has-a-json-body-processor-that)
- [Coraza multipart strict validation bypass via truncated body](https://junglewise.ai/threats/cve-2026-41508-coraza-truncated-multipart-body-bypasses-multipart-strict-error)
- [Coraza WAF argument limit bypass via parameter flooding](https://junglewise.ai/threats/cve-2026-41510-coraza-silent-argument-drop-at-argumentlimit-allows-bypass-of)