The vulnerability is in the JSON body processor of OWASP Coraza WAF. From version 3.0.0 through 3.8.0 the readJSON function limits its flattening walk after reaching SecArgumentsLimit or a byte budget, then calls gjson.Valid on the raw body. An unauthenticated attacker can supply shallow JSON values that meet the argument limit and then add an extremely deeply nested JSON structure that is not processed by the bounded walk. gjson.Valid recurses without a depth bound, resulting in an unrecoverable stack overflow that crashes the host process. The crash leads to a denial of service.

Corazawaf:Coraza web application firewall library, versions 3.0.0 up to and including 3.8.0 (fixed in 3.8.1).

The CVSS score of 7.5 classifies this as a high severity flaw. The exploit is possible with no authentication and requires the ability to send HTTP requests containing a JSON payload that respects body-size and argument-count limits but contains an excessively nested suffix. Although EPSS data is not available and the issue is not listed in the CISA KEV catalog, the lack of authentication and ease of payload composition make this a likely risk in deployed environments.