CVE-2026-116133 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything a...

GO-2026-6697 Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza...

PT-2026-118019

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza...

CVE-2026-41508 OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPARTSTRICTERROR. A remote attacker can submit a truncated...

CVE-2026-41508: Protection Mechanism Failure

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPARTSTRICTERROR. A remote attacker can submit a truncated...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

CVE-2026-107834

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) is vulnerable to resource exhaustion due to improper file handle management in the internal/bodyprocessors/multipart.go component. The multipart loop executes defer temp.Close() for every uploaded file part, preventing descriptors from ...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Summary defer temp.Close sits inside a for loop in the multipart processor. Go defers run at function return, not loop end, so every file part in the request holds an open fd until ProcessRequest exits. Send enough parts and you hit EMFILE. With CRS loaded, that flips MULTIPARTSTRICTERROR to 1 an...

GHSA-RP9V-7XV3-R6G3 Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Summary defer temp.Close sits inside a for loop in the multipart processor. Go defers run at function return, not loop end, so every file part in the request holds an open fd until ProcessRequest exits. Send enough parts and you hit EMFILE. With CRS loaded, that flips MULTIPARTSTRICTERROR to 1 an...

GHSA-R3RM-QPHW-HH76 Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

Root Cause File: internal/bodyprocessors/multipart.go since commit 3347961b, PR 1453 "feat: ignore unexpected EOF in MIME multipart request body processor", merged 2026-03-06, first shipped in v3.4.0. The multipart body processor treats io.ErrUnexpectedEOF as a benign condition. Three sites are...

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

Root Cause File: internal/bodyprocessors/multipart.go since commit 3347961b, PR 1453 "feat: ignore unexpected EOF in MIME multipart request body processor", merged 2026-03-06, first shipped in v3.4.0. The multipart body processor treats io.ErrUnexpectedEOF as a benign condition. Three sites are...

PT-2026-107376

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.4.0 through 3.7.0 Description The multipart processor in internal/bodyprocessors/multipart.go incorrectly treats io.ErrUnexpectedEOF as a non-fatal condition without setting the MULTIPART STRICT ERROR flag. This...

Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Response Splitting

The version of Spring Framework installed on the remote host is prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - Applications that build a Content-Disposition...

SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:4023-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4023-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-12548: out-of-bounds read in multipart body parser due to...

SUSE SLES12: libsoup-2_4-1 / libsoup-2_4-1-32bit / libsoup-devel / libsoup-lang / etc (SUSE-SU-2026:4105-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4105-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncatio...

SUSE-SU-2026:4105-1 Security update for libsoup

This update for libsoup fixes the following issue: - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196...

Security update for libsoup

This update for libsoup fixes the following issue: CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. Changes for libsoup2: update after changes in the public suffix list: ".bd" is no longer in the public suffix list so let's use ".jm" instead...