Live › vulnerability › GHSA-rp9v-7xv3-r6g3
Go to dashboardCoraza is a Go web application firewall library; versions 3.0.0 through 3.8.0 (exclusive) accumulate deferred file handles while processing multipart request bodies. An attacker who sends crafted multipart requests can exhaust the server's resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/corazawaf/coraza | go | all versions | – |
| github.com/corazawaf/coraza/v2 | go | all versions | – |
| github.com/corazawaf/coraza/v3 | go | >= 3.0.0, < 3.8.0 | 3.8.0 |
Run go list -m github.com/corazawaf/coraza/v3 in the project and check whether the version is >= 3.0.0 and < 3.8.0.
Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza
This page as .md · .json · in your agent: get_signal("GHSA-rp9v-7xv3-r6g3")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.