OWASP Coraza WAF silently drops request arguments beyond the SecArgumentsLimit value, while certain internal components fail to enforce the limit. As a result, an attacker can flood a request with a large number of parameters, causing the excess values to be omitted from the ARGS, ARGS_GET, ARGS_POST and related collections that downstream security rules evaluate. The dropped arguments can allow bypass of rule sets protecting the application, and the unbounded processing of large bodies can consume excessive memory, leading to performance degradation and potential denial of service.

Coraza, a golang ModSecurity-compatible web application firewall library, from version 3.0.0 up to and including 3.8.0 is affected. The fix is available in version 3.8.1 and later.

The CVSS score of 7.2 indicates a high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can exploit the flaw by sending request bodies or query strings that exceed the configured argument limits, resulting in silent drop of parameters and potential memory exhaustion. The flaw can be triggered over standard HTTP connections; the attack vector is likely network-based, with no special privileges required.