Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107834 · GHSA-rp9v-7xv3-r6g3

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Risk score
42/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.3%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauth…
Affected
github.com/corazawaf/coraza/v3 (go) >= 3.0.0, < 3.8.0
Fix
Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.
Exploitation
No known exploitation

Story map

Story map: github.com/corazawaf/coraza/v3THE FLAWSTHE FIXCVE-2026-107834Coraza: Resource exhaustionvia deferred file handleaccumulation in multipart…CVSS 5.3 · EPSS 0%CVE-2026-41510Coraza: Silent argument dropat ArgumentLimit allowsbypass of ARGS-targeted…CVSS 7.2 · EPSS 0%CVE-2026-107826Coraza JSON body processor:argument-limit truncationreopens an unbounded-depth…CVSS 7.5 · EPSS 0%CVE-2026-41508Coraza: Truncated multipartbody bypassesMULTIPART_STRICT_ERROR…CVSS 5.8 · EPSS 0%Upgrade…3.8.0 · 3.8.1or later on your release lineWho is exposedgithub.com/corazawaf/coraza/v3 (go) >= 3.0.0, < 3.8.1AMBER · PATCH THIS WEEKgithub.com/corazawaf/coraza/v3OWASP Coraza WAF is a golangmodsecurity compatible webapplication firewall library.From 3.0.0 until 3.8.1, Corazasilently drops arguments afterSecArgumentsLimit ininternal/corazawaf/transactio…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-400)256 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/corazawaf/coraza/v3: Amber, patch this week. OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when …

The flaws

  • CVE-2026-107834: Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor (CVSS 5.3 · EPSS 0%)
  • CVE-2026-41510: Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding (CVSS 7.2 · EPSS 0%)
  • CVE-2026-107826: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) (CVSS 7.5 · EPSS 0%)
  • CVE-2026-41508: Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling (CVSS 5.8 · EPSS 0%)

The fix

Upgrade github.com/corazawaf/coraza/v3: 3.8.0 · 3.8.1 or later on your release line

Who is exposed: github.com/corazawaf/coraza/v3 (go) >= 3.0.0, < 3.8.1

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/corazawaf/coraza/v3go>= 3.0.0, < 3.8.03.8.0

References

Original description

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.