Coraza versions 3.0.0 through 3.8.0 have a JSON body processor that flattens nested properties into dot‑separated ARGS_POST names without escaping literal dots, allowing distinct properties to collide. An unauthenticated attacker can supply a later dotted property such as account.role to overwrite a malicious nested value. This collision can hide SQL injection payloads from OWASP CRS rules while the backend still receives the potentially dangerous data, effectively bypassing the web application firewall.

The affected product is Coraza WAF, specifically the Coraza package. Versions from 3.0.0 up to but not including 3.8.1 are vulnerable. Systems running these releases are at risk unless updated or mitigated.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests exploit attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw can be exploited by sending a crafted JSON request containing conflicting key names, a technique that does not require authentication and could travel across the network to reach the affected WAF, making it a realistic risk for exposed web services.