{"id":"CVE-2026-41508","kind":"vulnerability","aliases":["CVE-2026-41508","GHSA-r3rm-qphw-hh76","GO-2026-6670"],"related":[],"title":"Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza","description":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.","summary":"The Coraza Go WAF library, versions 3.4.0 through 3.8.0, treats a truncated multipart body as a non-fatal parse error and does not set MULTIPART_STRICT_ERROR. An attacker can send a truncated multipart body so that the strict-error rules 200002 and 200003 never fire, letting multipart parser-disagreement payloads reach a backend that reads the body differently.","severity":"medium","cvss":5.8,"epss":0.00494,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.0"],"affected":">= 3.4.0, < 3.8.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","modsecurity","package","waf"],"not_affected_if":["coraza-3.8.0-or-later","coraza-below-3.4.0","no-multipart-body-inspection"],"how_to_check":"go list -m github.com/corazawaf/coraza/v3\nIf the reported version is >= 3.4.0 and < 3.8.0, the module is affected.","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.","status":"open","published_at":"2026-10-12T21:17:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:58:08+00:00","updated_at":"2026-10-23T19:58:08+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T19:58:08Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.\nunknown","summary":"The Coraza Go WAF library, versions 3.4.0 through 3.8.0, treats a truncated multipart body as a non-fatal parse error and does not set MULTIPART_STRICT_ERROR. An attacker can send a truncated multipart body so that the strict-error rules 200002 and 200003 never fire, letting multipart parser-disagreement payloads reach a backend that reads the body differently.","category":"package","who_cares":["go","coraza","waf","modsecurity"],"confidence":0.75,"analyst_note":"Sources list the unversioned github.com/corazawaf/coraza and /v2 modules as affected with fix unknown; check https://pkg.go.dev/vuln/GO-2026-6670 to confirm whether those module paths are actually affected.","how_to_check":"go list -m github.com/corazawaf/coraza/v3\nIf the reported version is >= 3.4.0 and < 3.8.0, the module is affected.\nunknown","needs_analyst":true,"not_affected_if":["coraza-below-3.4.0","coraza-3.8.0-or-later","no-multipart-body-inspection"],"severity_if_unknown":"medium"},"cost_usd":0.00085,"input_tokens":2394,"output_tokens":1221,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,28A,31A '-41508':21A,32A '-6670':29A '/corazawaf/coraza':18A,35A '/corazawaf/coraza/v2':38A '/corazawaf/coraza/v3':41A '200002':90B,169C '200003':10A,92B,171C '3.4.0':53B,122C '3.8.0':55B,124C,197C 'allow':175C 'applic':118C 'attack':76B,141C 'backend':103B,184C 'bodi':4A,60B,82B,107B,147C,189C 'bypass':5A 'caus':151C 'compat':116C 'coraza':1A,42B,48B,110C 'cve':19A,30A 'defens':166C 'differ':108B,190C 'disagr':99B,179C 'error':8A,67B,74B,88B,138C,160C 'fatal':65B 'fire':94B,174C 'firewal':119C 'fix':194C 'ghsa':23A 'ghsa-r3rm-qphw-hh76':22A 'github.com':17A,34A,37A,40A 'github.com/corazawaf/coraza':16A,33A 'github.com/corazawaf/coraza/v2':36A 'github.com/corazawaf/coraza/v3':39A 'go':27A,43B,49B 'golang':114C 'handl':14A 'hh76':26A 'internal/bodyprocessors/multipart.go':129C 'interpret':186C 'io.errunexpectedeof':13A,131C,150C 'issu':192C 'let':95B 'librari':51B,120C 'modsecur':44B,115C 'multipart':3A,6A,59B,72B,81B,96B,126C,136C,146C,176C 'never':93B 'non':64B 'non-fat':63B 'nonfat':133C 'owasp':109C 'packag':45B 'pars':66B,152C 'parser':98B,178C 'parser-disagr':97B,177C 'payload':100B,180C 'processor':127C 'produc':149C 'qphw':25A 'r3rm':24A 'rais':156C 'reach':101B,182C 'read':105B 'recommend':165C 'remot':140C 'rule':9A,89B,167C,168C 'send':78B 'set':71B,135C 'signal':161C 'silent':12A 'stop':154C 'strict':7A,73B,87B,137C,159C 'strict-error':86B,158C 'submit':143C 'treat':56B,130C 'truncat':2A,58B,80B,145C,188C 'use':162C 'version':52B,196C 'via':11A 'waf':46B,50B,111C 'web':117C 'without':134C,155C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T21:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6670","url":"https://pkg.go.dev/vuln/GO-2026-6670","severity":null,"published_at":"2026-10-20T00:20:51+00:00","modified_at":"2026-10-20T00:20:51+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-41508","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41508","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-41508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41508","severity":null,"published_at":"2026-10-12T21:17:17+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T19:14:51+00:00","fetched_at":"2026-10-23T19:14:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}