TI-2026-71309 Aliases CVE-2026-41508

Coraza WAF multipart parser skips strict error on truncated body

LOW 33CWE-693Published 2026-10-12 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-693.

Summary

OWASP Coraza WAF from 3.4.0 before 3.8.0 is affected. The multipart body processor treats a truncated body error (io.ErrUnexpectedEOF) as nonfatal without setting the MULTIPART_STRICT_ERROR flag (CWE-755). A remote unauthenticated attacker can send a truncated multipart body so rules 200002 and 200003 do not fire, letting multipart payloads that a backend parses differently pass through the WAF.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00497 42nd percentileScored 2026-11-07

Fix Fixed coraza (corazawaf): 3.8.0github.com/corazawaf/coraza/v3 (Go): 3.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
corazawaf	coraza	3.4.0 to before 3.8.0	3.8.0	Patch available	CNA
—	github.com/corazawaf/coraza/v3 (Go)	3.4.0 to before 3.8.0	3.8.0	Patch available	GHSA-r3rm-qphw-hh76

coraza Vendorcorazawaf Affected 3.4.0 to before 3.8.0 Fixed in 3.8.0 Patch available CNA
github.com/corazawaf/coraza/v3 (Go) Vendor— Affected 3.4.0 to before 3.8.0 Fixed in 3.8.0 Patch available GHSA-r3rm-qphw-hh76

Remediation

Upgrade the Go module github.com/corazawaf/coraza/v3 to version 3.8.0. The sources list no fixed version for coraza.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA coraza (corazawaf) Fixed in 3.8.0
Fix · GHSA-r3rm-qphw-hh76 github.com/corazawaf/coraza/v3 (Go) Fixed in 3.8.0 Advisory →

Timeline

2026-10-12 Threatist record created from CVE-2026-41508
2026-10-13 Priority changed: MEDIUM → LOW
2026-10-13 CISA SSVC decision points changed

References

Other 4

TI-2026-69592 Uncontrolled recursion in Coraza WAF JSON parsing crashes the process CVSS 3.1HIGH 7.5
TI-2026-71270 Coraza WAF silently drops arguments at ArgumentLimit, enabling rule bypass CVSS 3.1HIGH 7.2
TI-2026-71268 Off-by-one error in OWASP Coraza jsDecode enables WAF rule bypass CVSS 3.1MEDIUM 5.8
TI-2026-78712 Coraza JSON key collision lets SQL injection evade WAF rules CVSS 4.0MEDIUM 6.9
TI-2026-78714 Multipart filename* charset handling bypasses Coraza FILES rules CVSS 4.0MEDIUM 6.3
TI-2026-69596 Uncontrolled recursion in Coraza WAF JSON processing exhausts CPU CVSS 3.1MEDIUM 5.9

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences