Is CVE-2026-41510 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41510 being exploited in the wild.

How severe is CVE-2026-41510?

High severity, with a CVSS score of 7.2, published 12 October 2026.

Which products and versions are affected?

Coraza WAF v3.0.0 through v3.8.0; github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) >= 3.0.0, < 3.8.1, SEMVER:introduced=3.0.0,fixed=3.8.1.

How is CVE-2026-41510 attacked?

It is attacked over the network.

Am I affected by CVE-2026-41510?

Check whether you run Coraza WAF, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41510: Coraza WAF argument limit bypass via parameter flooding

Q: Is there a fix for CVE-2026-41510?

Yes. github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.1 or later. Until then: Until upgrading, apply the compensating rules shipped in coraza.conf-recommended that check ARGUMENTS_LIMIT_REACHED and deny requests that exceed per-collection argument limits. Alternatively, set SecArgumentsLimit to a lower threshold appropriate for legitimate application traffic to reduce bypass probability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41510 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-41510?

Check whether you run Coraza WAF, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41510 · Severity: high · CVSS 7.2 · Published 2026-10-12

Coraza is a web application firewall that inspects HTTP request parameters to block attacks like SQL injection and cross-site scripting. A flaw in how it enforces argument count limits allows attackers to silently discard parameters—including malicious payloads—by submitting thousands of dummy parameters, making attack payloads invisible to detection rules. Additionally, POST request bodies can accumulate unbounded arguments, and JSON flattening can consume excessive memory.

Technologies: github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go), github.com/corazawaf/coraza/v3 (Go). Vendors: Coraza, Go.

Quick answers

Is CVE-2026-41510 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41510 being exploited in the wild.
How severe is CVE-2026-41510?: High severity, with a CVSS score of 7.2, published 12 October 2026.
Which products and versions are affected?: Coraza WAF v3.0.0 through v3.8.0; github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) >= 3.0.0, < 3.8.1, SEMVER:introduced=3.0.0,fixed=3.8.1.
Is there a fix for CVE-2026-41510?: Yes. github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.1 or later. Until then: Until upgrading, apply the compensating rules shipped in coraza.conf-recommended that check ARGUMENTS_LIMIT_REACHED and deny requests that exceed per-collection argument limits. Alternatively, set SecArgumentsLimit to a lower threshold appropriate for legitimate application traffic to reduce bypass probability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41510 attacked?: It is attacked over the network.
Am I affected by CVE-2026-41510?: Check whether you run Coraza WAF, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.1 or later
```
go get github.com/corazawaf/coraza/v3@v3.8.1
```

Until upgrading, apply the compensating rules shipped in coraza.conf-recommended that check ARGUMENTS_LIMIT_REACHED and deny requests that exceed per-collection argument limits. Alternatively, set SecArgumentsLimit to a lower threshold appropriate for legitimate application traffic to reduce bypass probability.

Technical details

The vulnerability stems from silent drops when per-collection argument counts exceed SecArgumentsLimit (default 1000): AddGetRequestArgument, AddPostRequestArgument, and AddPathRequestArgument return without setting any flag or error, and Go's randomized map iteration in ExtractGetArguments makes which arguments survive non-deterministic. A secondary issue in the urlencoded body processor bypasses the limit entirely for POST data. An attacker flooding a request with thousands of filler parameters can achieve ~94% bypass rates against ARGS-targeted rules via probabilistic payload placement; no transaction-visible error or audit log entry exists. Fixed in v3.8.1 by introducing ARGUMENTS_LIMIT_REACHED flag, enforcing limits in body processors, and making GET argument extraction deterministic.

Affected products

Coraza WAF v3.0.0 through v3.8.0

Identifiers

CVE-2026-41510
GHSA-6r3q-mjv7-xr8m
GO-2026-6668

Timeline

2026-10-06: disclosed: Advisory GHSA-6r3q-mjv7-xr8m published
2026-10-02: patched: v3.8.1 released with complete fix including array-length byte-budget check
2026-07-28: patched: v3.8.0 released with initial mitigation (incomplete; array-length bypass remained)

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.