Coraza versions 3.0.4 through 3.8.0 inspect the request body only when the Exact Content‑Type header matches a known media type; if the header contains a parameter such as '; charset=UTF-8', the body is never parsed. An unauthenticated attacker can send form data with the header application/x-www-form-urlencoded; charset=UTF-8, causing ARGS_POST and REQUEST_BODY to stay empty while the backend still receives and processes the payload. This flaw, categorized as CWE‑20 (Improper Input Validation), allows malicious input to bypass all WAF rules that rely on body parsing, potentially facilitating injection, XSS, or other application‑level attacks.

The vulnerable product is Coraza Web Application Firewall from vendor corazawaf. Versions affected include all releases from 3.0.4 up to but excluding 3.8.1, where the request‑body inspection logic was fixed.

The CVSS score of 6.9 reflects a moderate impact for a typical deployment, but the EPSS score of less than 1% indicates a relatively low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need only to craft an HTTP request with an atypical Content‑Type header; no authentication or privileged access is required. Given the ease of construction and the potential to evade monitoring, the risk to critical or sensitive data remains significant.