GHSA-6gcq-wc29-5xf2: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

October 8, 2026 (updated October 9, 2026)

The JSON body processor (internal/bodyprocessors/json.go) can be made to crash the whole process with an unrecoverable fatal error: stack overflow, using a request body that is well under the recommended SecRequestBodyLimit and the default SecArgumentsLimit.

References

github.com/advisories/GHSA-6gcq-wc29-5xf2
github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f
github.com/corazawaf/coraza/releases/tag/v3.8.1
github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2
nvd.nist.gov/vuln/detail/CVE-2026-107826

Code Behaviors & Features

Detect and mitigate GHSA-6gcq-wc29-5xf2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →