CVE-2026-104774

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104774
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104774.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104774
Aliases
Published
2026-10-12T19:58:39Z
Modified
2026-10-15T02:30:33Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
Details

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-172",
        "CWE-193",
        "CWE-693"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104774.json"
}
References

Affected packages

Git / github.com/corazawaf/coraza

Affected ranges

Type
GIT
Repo
https://github.com/corazawaf/coraza
Events
Introduced
ad50864cfa00f5143fff7f6877847326fdc4b394
Fixed
f9b7afdbcedce7ad814663eaee2e342578ea3bb2
Fixed
19b86824f5e97eba72b289a81d5b3c1260292ff0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.0.0"
        },
        {
            "fixed":  "3.8.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.1.0
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.4.0
v3.5.0
v3.6.0
v3.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104774.json"