vulnerability · Thu 08 Oct 2026 · 17:45 UTC
GHSA-6gcq-wc29-5xf2: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow
Filed UTCSource GTH ↗
The JSON body processor (internal/bodyprocessors/json.go) can be made to crash the whole process with an unrecoverable fatal error: stack overflow, using a request body that is well under the recommended SecRequestBodyLimit and the default SecArgumentsLimit. ### Root cause readJSON (json.go:113-143) runs a bounded, best-effort flattening walk (readItems) and *afterwards* calls gjson.Valid(s) on the raw body if readItems returned no error: ```go json := gjson.Parse(s) ... …
Signals
as the pipeline stamped them- High
- High-risk vulnerability — CVSS 7.5
Indicators
checking abuse.ch ThreatFoxChecking indicators against ThreatFox…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.