CVE-2026-107826

Summary

OWASP Coraza WAF's JSON parsing function can crash due to unbounded recursion when processing deeply nested JSON structures, leading to denial of service. An attacker can trigger this by crafting a payload with shallow initial values and an extremely deep nested tail that bypasses the bounded flattening walk.

Exploitability

Very easy to exploit with no prerequisites; an unauthenticated attacker can send a specially crafted JSON payload that triggers stack overflow without requiring any authentication or session state.

Blast radius

High impact across all applications using vulnerable Coraza WAF versions, potentially causing widespread service disruption as the hosting process crashes and restarts.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.8.1 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.