CVE-2026-41508
5.8MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-693, CWE-755
Impact
Remote unauthenticated attackers can bypass WAF rules 200002 and 200003 using truncated multipart bodies, letting malicious payloads reach backends that parse truncated data differently. This requires sending an HTTP request with an incomplete multipart payload over the network.
Root cause
The multipart processor treats io.ErrUnexpectedEOF as nonfatal without setting the MULTIPART_STRICT_ERROR flag, silently stopping parsing instead of triggering strict-error detection rules.
Affected systems
OWASP Coraza WAF 3.4.0 through versions prior to 3.8.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Fix & remediation
Upgrade the Coraza Go dependency to version 3.8.0. No interim configuration mitigation is specified, so you must rebuild and redeploy your service with the updated package.
$ go get github.com/corazawaf/coraza/v3@v3.8.0 && go mod tidyAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.