Issues

• SecRuleRemoveByMsg panics with nil pointer dereference when a previously loaded rule has no msg action

  corazawaf/coraza#1736 · Filter by author AlfredoFausto opened on Oct 8, 2026
  1

• Concurrent ctl:ruleRemoveTargetById removals overwrite each other (data race on Exceptions)

  corazawaf/coraza#1723 · Filter by author rforced opened on Sep 29, 2026

• redirect/drop disruptive actions on the request phase are silently downgraded to 200 in the net/http connector

  bug
  corazawaf/coraza#1718 · Filter by author fzipi opened on Sep 22, 2026
  1

  

• net/http integration: drop/redirect interruption actions fall through to default 200 OK (docs/capability gap)

  corazawaf/coraza#1717 · Filter by author kta1kri opened on Sep 20, 2026

• Implement RESPONSE_XML support

  corazawaf/coraza#1714 · Filter by author fzipi opened on Sep 3, 2026

• URLENCODED_ERROR is never set for the condition it documents; the decoder cannot detect it

  bugseclang
  corazawaf/coraza#1696 · Filter by author fzipi opened on Aug 28, 2026

• 15 MULTIPART_* variables are declared but never populated, so rules referencing them silently never match

  bugseclang
  corazawaf/coraza#1687 · Filter by author fzipi opened on Aug 24, 2026

• Concurrent audit log writer: transaction ID is unsanitized in the audit record file path

  corazawaf/coraza#1686 · Filter by author fzipi opened on Aug 24, 2026
  4

• REQUEST_BODY is not populated when a body processor ran (XML/JSON), diverging from libmodsecurity v3

  corazawaf/coraza#1685 · Filter by author fzipi opened on Aug 19, 2026
  2

• Transformation cache misses on map-backed collections

  corazawaf/coraza#1681 · Filter by author M4tteoP opened on Aug 12, 2026
  1

• msg/logdata macros are expanded on every rule evaluation, emitting spurious "key not found in collection" warnings

  corazawaf/coraza#1675 · Filter by author blotus opened on Jul 28, 2026
  

• cookieParser misinterepretaion of unicode cookie values

  corazawaf/coraza#1674 · Filter by author HackingRepo opened on Jul 28, 2026

• jsDecode confusion in some cases

  corazawaf/coraza#1668 · Filter by author HackingRepo opened on Jul 26, 2026
  1

• Remove Comment vulnerable to some bypasses

  corazawaf/coraza#1667 · Filter by author HackingRepo opened on Jul 26, 2026

• Replace Comment transformation have some loopholes

  corazawaf/coraza#1666 · Filter by author HackingRepo opened on Jul 26, 2026

• CSS Decode transformation not handle \r\n

  corazawaf/coraza#1665 · Filter by author HackingRepo opened on Jul 26, 2026
  1

• Performance issue at WAF compilation

  corazawaf/coraza#1644 · Filter by author racheedevel opened on Jul 21, 2026

• SQL Injection detection fails for URL-encoded payloads due to missing t:urlDecode transformation in rule 942100

  corazawaf/coraza#1643 · Filter by author vagrantsd opened on Jul 21, 2026

• Large octet-stream request bodies are force-parsed into REQUEST_BODY/ARGS and transformed → memory blow-up (SecRequestBodyNoFilesLimit not enforced; forced URLENCODED vs RAW)

  corazawaf/coraza#1628 · Filter by author jptosso opened on Jun 8, 2026
  1

• Coraza no longer 'best effort' parses JSON messages larger than configured SecRequestBodyLimit

  corazawaf/coraza#1611 · Filter by author Kortekaasy opened on Apr 16, 2026
  2

• feat: depth-first evaluation for chained SecRule directives

  enhancement
  corazawaf/coraza#1608 · Filter by author fzipi opened on Apr 7, 2026

• feat: encrypted audit log fields for sensitive phases

  enhancement
  corazawaf/coraza#1607 · Filter by author fzipi opened on Apr 7, 2026

• Add support for short syntax on pm operator.

  corazawaf/coraza#1600 · Filter by author fzipi opened on Apr 5, 2026
  

• Hardcode version number in constant for each tag

  corazawaf/coraza#1590 · Filter by author jptosso opened on Apr 2, 2026
  4

• Include Owasp CRS by default

  corazawaf/coraza#1581 · Filter by author jptosso opened on Mar 31, 2026