CVE-2026-41508
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.
- CVSS 3.1
- 5.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-693, CWE-755
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r3rm-qphw-hh76 | Go | github.com/corazawaf/coraza/v3 | >=3.4.0 <3.8.0 | 3.8.0 |
| GO-2026-6670 | Go | github.com/corazawaf/coraza | all versions | no fix published |
| GO-2026-6670 | Go | github.com/corazawaf/coraza/v2 | all versions | no fix published |
| GO-2026-6670 | Go | github.com/corazawaf/coraza/v3 | >=3.4.0 <3.8.0 | 3.8.0 |