All issues

Search results

msg/logdata macros are expanded on every rule evaluation, emitting spurious "key not found in collection" warnings

Status: Open.

#1675 In corazawaf/coraza;

· blotus opened on Jul 28, 2026

cookieParser misinterepretaion of unicode cookie values

Status: Open.

#1674 In corazawaf/coraza;

· HackingRepo opened on Jul 28, 2026

normalise path and normalise path win too transformations return changed true for some cases even if the path not touched

Status: Open.

#1670 In corazawaf/coraza;

· HackingRepo opened on Jul 26, 2026

jsDecode confusion in some cases

Status: Open.

#1668 In corazawaf/coraza;

· HackingRepo opened on Jul 26, 2026

Remove Comment vulnerable to some bypasses

Status: Open.

#1667 In corazawaf/coraza;

· HackingRepo opened on Jul 26, 2026

Replace Comment transformation have some loopholes

Status: Open.

#1666 In corazawaf/coraza;

· HackingRepo opened on Jul 26, 2026

CSS Decode transformation not handle \r\n

Status: Open.

#1665 In corazawaf/coraza;

· HackingRepo opened on Jul 26, 2026

jsDecode doesn't decode ES2015+ \u{...} extended Unicode escapes

bugSomething isn't workingSomething isn't working

fixFixes something brokenFixes something broken

security

Status: Open.

#1653 In corazawaf/coraza;

· fzipi opened on Jul 25, 2026

Performance issue at WAF compilation

Status: Open.

#1644 In corazawaf/coraza;

· racheedevel opened on Jul 21, 2026

SQL Injection detection fails for URL-encoded payloads due to missing t:urlDecode transformation in rule 942100

Status: Open.

#1643 In corazawaf/coraza;

· vagrantsd opened on Jul 21, 2026

Large octet-stream request bodies are force-parsed into REQUEST_BODY/ARGS and transformed → memory blow-up (SecRequestBodyNoFilesLimit not enforced; forced URLENCODED vs RAW)

Status: Open.

#1628 In corazawaf/coraza;

· jptosso opened on Jun 8, 2026

_abck cookie not indexed in REQUEST_COOKIES_NAMES when value contains ~ and /

Status: Open.

#1620 In corazawaf/coraza;

· ZeJ0hn opened on May 18, 2026