CVE-2026-41510
Received Received - Intake

OWASP Coraza WAF Argument Limit Bypass

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-41510

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
corazawaf coraza >= 3.0.0, < 3.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-41510 is a vulnerability in OWASP Coraza WAF versions 3.0.0 to 3.8.1 where excess arguments in requests are silently dropped without triggering alerts. This allows unauthenticated attackers to bypass security rules by flooding requests with parameters, causing malicious payloads to be omitted before rule inspection. The flaw affects ARGS, ARGS_GET, ARGS_POST, and JSON/URL-encoded processing, leading to potential memory exhaustion and service degradation.

Detection Guidance

To detect CVE-2026-41510, monitor for excessive memory usage during request processing, especially with JSON or URL-encoded bodies. Check for dropped arguments by enabling ARGUMENTS_LIMIT_REACHED flags in logs. Use tools like curl to send test requests with large parameter counts and observe if arguments are silently omitted.

Impact Analysis

This vulnerability can allow attackers to bypass WAF protections, evade detection of attacks like SQL injection or XSS, and cause system slowdowns or crashes due to memory exhaustion. Attackers may exploit it to send requests with excessive parameters, leading to unpredictable rule evasion or resource exhaustion in the WAF or downstream applications.

Mitigation Strategies

Upgrade Coraza WAF to version 3.8.1 or later immediately. Apply compensating rules from coraza.conf-recommended to enforce argument limits. Configure strict SecArgumentsLimit settings and monitor for ARGUMENTS_LIMIT_REACHED events. Disable JSON/URL-encoded processing for untrusted inputs if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41510. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart