Detections
Analytics
SCA: security update for github.com/corazawaf/coraza/v3 (GHSA-pc5q-qfxp-ggqv)
medium Tenable Self-Hosted Container Security Plugin ID 473849
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until
3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash
in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule
relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated
attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes
while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules
and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue
is fixed in version 3.8.0. (CVE-2026-104774)
Solution
Update the github.com/corazawaf/coraza/v3 library and its related packages to version 3.8.0 or later.See Also
Plugin Details
Severity: Medium
ID: 473849
Version: Revision 1.2
Type: Local
Family: SCA Checks
Published: 10/8/2026
Updated: 10/13/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2026-104774
CVSS v3
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 5.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/8/2026
Vulnerability Publication Date: 10/8/2026
Reference Information
CVE: CVE-2026-104774