# CVE-2026-41510: Coraza WAF argument limit bypass via parameter flooding

Source: https://junglewise.ai/threats/cve-2026-41510-coraza-silent-argument-drop-at-argumentlimit-allows-bypass-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-41510 · Severity: high · CVSS 7.2 · Published 2026-10-12

Coraza is a web application firewall that inspects HTTP request parameters to block attacks like SQL injection and cross-site scripting. A flaw in how it enforces argument count limits allows attackers to silently discard parameters—including malicious payloads—by submitting thousands of dummy parameters, making attack payloads invisible to detection rules. Additionally, POST request bodies can accumulate unbounded arguments, and JSON flattening can consume excessive memory.

Technologies: [github.com/corazawaf/coraza (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza), [github.com/corazawaf/coraza/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza-v2), [github.com/corazawaf/coraza/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza-v3). Vendors: [Coraza](https://junglewise.ai/threats/vendors/coraza), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-41510 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41510 being exploited in the wild.

**How severe is CVE-2026-41510?** High severity, with a CVSS score of 7.2, published 12 October 2026.

**Which products and versions are affected?** Coraza WAF v3.0.0 through v3.8.0; github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) >= 3.0.0, < 3.8.1, SEMVER:introduced=3.0.0,fixed=3.8.1.

**Is there a fix for CVE-2026-41510?** Yes. github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.1 or later. Until then: Until upgrading, apply the compensating rules shipped in coraza.conf-recommended that check ARGUMENTS_LIMIT_REACHED and deny requests that exceed per-collection argument limits. Alternatively, set SecArgumentsLimit to a lower threshold appropriate for legitimate application traffic to reduce bypass probability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41510 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-41510?** Check whether you run Coraza WAF, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.1 or later

  ```sh
  go get github.com/corazawaf/coraza/v3@v3.8.1
  ```


Until upgrading, apply the compensating rules shipped in coraza.conf-recommended that check ARGUMENTS_LIMIT_REACHED and deny requests that exceed per-collection argument limits. Alternatively, set SecArgumentsLimit to a lower threshold appropriate for legitimate application traffic to reduce bypass probability.

## Technical details

The vulnerability stems from silent drops when per-collection argument counts exceed SecArgumentsLimit (default 1000): AddGetRequestArgument, AddPostRequestArgument, and AddPathRequestArgument return without setting any flag or error, and Go's randomized map iteration in ExtractGetArguments makes which arguments survive non-deterministic. A secondary issue in the urlencoded body processor bypasses the limit entirely for POST data. An attacker flooding a request with thousands of filler parameters can achieve ~94% bypass rates against ARGS-targeted rules via probabilistic payload placement; no transaction-visible error or audit log entry exists. Fixed in v3.8.1 by introducing ARGUMENTS_LIMIT_REACHED flag, enforcing limits in body processors, and making GET argument extraction deterministic.

## Affected products

- Coraza WAF v3.0.0 through v3.8.0

## Identifiers

- CVE-2026-41510
- GHSA-6r3q-mjv7-xr8m
- GO-2026-6668

## Timeline

- 2026-10-06: disclosed: Advisory GHSA-6r3q-mjv7-xr8m published
- 2026-10-02: patched: v3.8.1 released with complete fix including array-length byte-budget check
- 2026-07-28: patched: v3.8.0 released with initial mitigation (incomplete; array-length bypass remained)

## Related threats

- [Coraza multipart filename rule bypass via RFC 5987 charset handling](https://junglewise.ai/threats/cve-2026-114101-coraza-before-3-8-1-extracts-multipart-upload-filenames-with-go)
- [Coraza request body inspection bypass in Content-Type parsing](https://junglewise.ai/threats/cve-2026-114100-coraza-from-3-0-4-before-3-8-1-contains-a-request-body)
- [Coraza JSON body processor key collision WAF bypass](https://junglewise.ai/threats/cve-2026-114099-coraza-from-3-0-0-before-3-8-1-has-a-json-body-processor-that)
- [Coraza multipart strict validation bypass via truncated body](https://junglewise.ai/threats/cve-2026-41508-coraza-truncated-multipart-body-bypasses-multipart-strict-error)
- [Coraza CRLF injection in Native audit-log format](https://junglewise.ai/threats/cve-2026-41504-coraza-native-audit-log-format-allows-crlf-injection-and-log)