{"id":"GHSA-rp9v-7xv3-r6g3","kind":"vulnerability","aliases":["GHSA-rp9v-7xv3-r6g3","GO-2026-6697"],"related":[],"title":"Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza","description":"Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza","summary":"Coraza is a Go web application firewall library; versions 3.0.0 through 3.8.0 (exclusive) accumulate deferred file handles while processing multipart request bodies. An attacker who sends crafted multipart requests can exhaust the server's resources.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.0"],"affected":">= 3.0.0, < 3.8.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","package","self-hosted","waf"],"not_affected_if":["default-config"],"how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` in the project and check whether the version is >= 3.0.0 and < 3.8.0.","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.","status":"open","published_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:30+00:00","updated_at":"2026-10-23T20:15:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:30Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.\nunknown","summary":"Coraza is a Go web application firewall library; versions 3.0.0 through 3.8.0 (exclusive) accumulate deferred file handles while processing multipart request bodies. An attacker who sends crafted multipart requests can exhaust the server's resources.","category":"package","who_cares":["go","waf","coraza","self-hosted"],"confidence":0.6,"analyst_note":"Sources do not give a severity, CVSS, or whether the multipart parsing path is reachable in default configs; check https://pkg.go.dev/vuln/GO-2026-6697 and the GHSA advisory for details. Also note the unversioned github.com/corazawaf/coraza and /v2 products show 'fixed ?', so their status is unclear.","how_to_check":"Run `go list -m github.com/corazawaf/coraza/v3` in the project and check whether the version is >= 3.0.0 and < 3.8.0.\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"severity_if_unknown":"unknown"},"cost_usd":0.000409,"input_tokens":2089,"output_tokens":401,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':23A '-6697':24A '/corazawaf/coraza':16A,32A,96C '/corazawaf/coraza/v2':35A '/corazawaf/coraza/v3':38A '3.0.0':55B '3.8.0':57B '7xv3':20A,28A 'accumul':8A,59B,88C 'applic':51B 'attack':69B 'bodi':11A,67B,91C 'coraza':1A,39B,46B,81C 'craft':72B 'defer':5A,60B,85C 'exclus':58B 'exhaust':3A,76B,83C 'file':6A,61B,86C 'firewal':52B 'ghsa':18A,26A 'ghsa-rp9v-7xv3-r6g3':17A,25A 'github.com':15A,31A,34A,37A,95C 'github.com/corazawaf/coraza':14A,30A,94C 'github.com/corazawaf/coraza/v2':33A 'github.com/corazawaf/coraza/v3':36A 'go':22A,40B,49B 'handl':7A,62B,87C 'host':44B 'librari':53B 'multipart':10A,65B,73B,90C 'packag':41B 'process':64B 'processor':12A,92C 'r6g3':21A,29A 'request':66B,74B 'resourc':2A,80B,82C 'rp9v':19A,27A 'self':43B 'self-host':42B 'send':71B 'server':78B 'version':54B 'via':4A,84C 'waf':45B 'web':50B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6697","url":"https://pkg.go.dev/vuln/GO-2026-6697","severity":null,"published_at":"2026-10-19T21:08:17+00:00","modified_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}