Read the docs
TI-2026-69598 Aliases CVE-2026-107834GHSA-rp9v-7xv3-r6g3

Coraza WAF leaks temporary file descriptors on multipart uploads

Priority LOW 30CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

OWASP Coraza WAF from 3.0.0 before 3.8.0 is affected. Its multipart body processor defers closing each temporary file until the whole request returns, so file descriptors accumulate (CWE-772). An unauthenticated remote attacker can send a multipart body with many small file parts to exhaust the process file descriptor table, causing failed uploads and an inability to open files or sockets.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Fix Fixed coraza (corazawaf): 3.8.0github.com/corazawaf/coraza/v3 (Go): 3.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
corazawafcoraza3.0.0 to before 3.8.03.8.0Patch availableCNA
—github.com/corazawaf/coraza/v3 (Go)3.0.0 to before 3.8.03.8.0Patch availableGHSA-rp9v-7xv3-r6g3
  • coraza Vendorcorazawaf Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available CNA
  • github.com/corazawaf/coraza/v3 (Go) Vendor— Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available GHSA-rp9v-7xv3-r6g3

Remediation

Upgrade the Go module github.com/corazawaf/coraza/v3 to 3.8.0. The sources list no fixed version for coraza.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA coraza (corazawaf) Fixed in 3.8.0
  • Fix · GHSA-rp9v-7xv3-r6g3 github.com/corazawaf/coraza/v3 (Go) Fixed in 3.8.0 Advisory →

Timeline

  1. 2026-10-08 Threatist record created from GHSA-rp9v-7xv3-r6g3
  2. 2026-10-09 Alias added: CVE-2026-107834
  3. 2026-10-10 Title updated · CNA
  4. 2026-10-10 CVSS score added · CNA
  5. 2026-10-10 Weakness changed · CNA
  6. 2026-10-10 Affected versions changed · CNA
  7. 2026-10-10 3 new references · CNA
  8. 2026-10-13 CISA SSVC decision points changed

References

Other 4

  • TI-2026-69592 Uncontrolled recursion in Coraza WAF JSON parsing crashes the process CVSS 3.1HIGH 7.5
  • TI-2026-71270 Coraza WAF silently drops arguments at ArgumentLimit, enabling rule bypass CVSS 3.1HIGH 7.2
  • TI-2026-71268 Off-by-one error in OWASP Coraza jsDecode enables WAF rule bypass CVSS 3.1MEDIUM 5.8
  • TI-2026-78712 Coraza JSON key collision lets SQL injection evade WAF rules CVSS 4.0MEDIUM 6.9
  • TI-2026-78714 Multipart filename* charset handling bypasses Coraza FILES rules CVSS 4.0MEDIUM 6.3
  • TI-2026-69596 Uncontrolled recursion in Coraza WAF JSON processing exhausts CPU CVSS 3.1MEDIUM 5.9
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences