CVE-2026-41504

Received Received - Intake

OWASP Coraza WAF Native Audit Log Injection via CRLF

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-41504

Affected Vendors & Products

Vendor	Product	Version / Range
corazawaf	coraza	>= 3.0.0, < 3.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-117	The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

OWASP Coraza WAF versions 3.0.0 to 3.8.0 have a flaw in the Native audit-log formatter. Attackers can inject carriage returns and line feeds into request or response data, creating forged lines in transaction records. This misleads operators and SIEM systems but cannot fully impersonate separate sessions due to unpredictable transaction boundaries.

Detection Guidance

To detect this vulnerability, check if you are running Coraza WAF versions between 3.0.0 and 3.8.0. Verify if SecAuditLogFormat Native is enabled in your configuration. Inspect audit logs for unexpected line breaks or forged entries in transaction records.

Impact Analysis

If you use Coraza WAF with SecAuditLogFormat Native enabled, attackers could manipulate logs to hide malicious activity or create false entries. This may lead to incorrect security assessments, missed threats, or operational confusion during incident response.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing forged audit log entries. Attackers could inject line breaks into transaction records, misleading operators and SIEM processing. This may compromise the integrity of audit trails required for regulatory compliance.

Mitigation Strategies

Upgrade Coraza WAF to version 3.8.0 or later to fix the issue. If upgrading is not immediately possible, disable the Native audit-log formatter or review audit logs for suspicious entries.

Hi! I’m here to help you understand CVE-2026-41504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70