ModSecurity-compatible WAF library in Go
OWASP WAF library written in Go, compatible with ModSecurity SecLang rules and the OWASP Core Rule Set, embeddable in Go apps and proxies.
Coraza implements the ModSecurity rule language in Go, so existing rules and the OWASP Core Rule Set run on it. It is designed to be embedded: as middleware in Go applications, as a Caddy module, as a proxy-wasm filter for Envoy and others.
It is an OWASP production project.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
14 published advisories for Coraza in GitHub repository advisories and OSV.dev; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.
GHSA-6gcq-wc29-5xf2CVE-2026-107826high2026-10-02
JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
GHSA-3c6w-j9xm-8h2hCVE-2026-107833medium2026-10-02
Unbounded recursion in JSON response body processor causes CPU exhaustion
GHSA-rp9v-7xv3-r6g3CVE-2026-107834medium2026-10-02
Resource exhaustion via deferred file handle accumulation in multipart body processor
GHSA-5gj4-9gm7-2fx2medium2026-10-02
JSON key collision in Coraza body processor allows unauthenticated attackers to bypass OWASP CRS inspection
GHSA-w253-m66g-rx24medium2026-10-02
URL-encoded form Content-Type parameters bypass Coraza body inspection
GHSA-3wr7-993q-jrffmedium2026-10-02
Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules
GHSA-g4qm-m288-5cp9CVE-2026-107835medium2026-10-02
Cookie Parser Confusion
GHSA-pc5q-qfxp-ggqvCVE-2026-104774medium2026-10-02
jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
GHSA-x26q-wvhg-fh4mCVE-2026-107825medium2026-10-02
ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
GHSA-prpw-wwv7-xjjrCVE-2026-41504medium2026-10-02
Native audit-log format allows CRLF injection and log forgery via request body and header fields
GHSA-r3rm-qphw-hh76CVE-2026-41508medium2026-10-02
Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling
GHSA-6r3q-mjv7-xr8mCVE-2026-41510high2026-10-02
Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Collaborative behaviour-based IPS
Security engine that parses logs to detect aggressive behaviour, blocks it with remediation components and shares signals in a community blocklist.
Nginx-based web application firewall
WAF and hardened reverse proxy based on Nginx, with ModSecurity and the OWASP CRS, bot protection and a web UI, for Docker, Kubernetes or Linux.
Web application firewall engine
Cross-platform WAF engine (libmodsecurity) for Apache, Nginx and IIS, typically used with the OWASP Core Rule Set. Now an OWASP project.
