MEDIUM 5.8 GitHub
CVE-2026-41504
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields
## Root Cause
File: `internal/auditlog/formats.go` — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping `\r` or `\n`:
```go
// Part B — request headers (lines 72–80)
for k, vv := range al.Transaction().Request().Headers() {
for _, v := range vv {
res.WriteByte('\n')
res.WriteString(k)
res.WriteString(": ")
res.WriteString(v) // ← raw
}
}
// Part C — request body (lines 85–86)
if body := al.Transaction().Re
Affected Products
- go/github.com/corazawaf/coraza/v3 >= 3.0.0, <= 3.7.0
References
- https://github.com/advisories/GHSA-prpw-wwv7-xjjr
- https://github.com/corazawaf/coraza/security/advisories/GHSA-prpw-wwv7-xjjr
- https://github.com/corazawaf/coraza/commit/a3079325547c7c1e08522aed4d6468f25d080e25
- https://github.com/corazawaf/coraza/releases/tag/v3.8.0
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-10-06 via GitHub. Affected: go/github.com/corazawaf/coraza/v3 >= 3.0.0, <= 3.7.0.
vulnfeed aggregates 9512 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.