CVE-2026-41508
Description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.
How to fix
- github.com/corazawaf/coraza/v33.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/corazawaf/coraza/v3Go | 3.4.0 ≤ v < 3.8.0 | 3.8.0 |
| github.com/corazawaf/corazaGo | No range specified | — |
| github.com/corazawaf/coraza/v2Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.