The vulnerability arises from the Native audit‑log formatter in Coraza WAF, which writes request and response data directly without neutralizing carriage returns or line feeds. An attacker who can control the request or response body, header, error‑message or matched‑rule data can inject CRLF sequences that are interpreted as new log lines. This results in forged audit entries that can mislead operators and corrupt line‑oriented SIEM processing. Although the injection does not produce a separate tampered session because transaction boundaries remain unpredictable, the ability to modify audit logs can facilitate covert activity and obscure malicious behaviour.

Affected systems include the OWASP Coraza Web Application Firewall, versions 3.0.0 through 3.8.0. All releases up to but excluding 3.8.0 are impacted. The vulnerability was fixed in the 3.8.0 release.

The CVSS base score of 5.8 indicates moderate severity. The EPSS score is not available, and the bug does not appear in the CISA KEV catalog. The likely attack vector is remote; a web attacker can craft HTTP requests that include malicious CRLF payloads in body or header fields to trigger the injection. Because this flaw alters log output rather than directly impacting application logic, exploitation would primarily compromise post‑incident visibility and monitoring but does not grant direct code execution or privilege escalation.