GO-2026-6697 Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

CVE-2026-107834

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) is vulnerable to resource exhaustion due to improper file handle management in the internal/bodyprocessors/multipart.go component. The multipart loop executes defer temp.Close() for every uploaded file part, preventing descriptors from ...

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Summary defer temp.Close sits inside a for loop in the multipart processor. Go defers run at function return, not loop end, so every file part in the request holds an open fd until ProcessRequest exits. Send enough parts and you hit EMFILE. With CRS loaded, that flips MULTIPARTSTRICTERROR to 1 an...

GHSA-RP9V-7XV3-R6G3 Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Summary defer temp.Close sits inside a for loop in the multipart processor. Go defers run at function return, not loop end, so every file part in the request holds an open fd until ProcessRequest exits. Send enough parts and you hit EMFILE. With CRS loaded, that flips MULTIPARTSTRICTERROR to 1 an...

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

Root Cause File: internal/bodyprocessors/multipart.go since commit 3347961b, PR 1453 "feat: ignore unexpected EOF in MIME multipart request body processor", merged 2026-03-06, first shipped in v3.4.0. The multipart body processor treats io.ErrUnexpectedEOF as a benign condition. Three sites are...

GHSA-R3RM-QPHW-HH76 Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

Root Cause File: internal/bodyprocessors/multipart.go since commit 3347961b, PR 1453 "feat: ignore unexpected EOF in MIME multipart request body processor", merged 2026-03-06, first shipped in v3.4.0. The multipart body processor treats io.ErrUnexpectedEOF as a benign condition. Three sites are...

PT-2026-107376

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.4.0 through 3.7.0 Description The multipart processor in internal/bodyprocessors/multipart.go incorrectly treats io.ErrUnexpectedEOF as a non-fatal condition without setting the MULTIPART STRICT ERROR flag. This...