EUVD-2026-385200

fkie_cve-2026-107834

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.

GHSA-rp9v-7xv3-r6g3 — Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Affected: Go: github.com/corazawaf/coraza/v3

## Summary

`defer temp.Close()` sits inside a `for` loop in the multipart processor. Go defers run at function return, not loop end, so every file part in the request holds an open fd until `ProcessRequest()` exits. Send enough parts and you hit `EMFILE`. With CRS loaded, that flips `MULTIPART_STRICT_ERROR` to 1 and rule `200001` starts returning 400s, including on legitimate requests hitting the same condition.

## Details

`internal/bodyprocessors/multipart.go`, line 69:

```go for { p, err := mr.NextPart() // ... temp, err := os.CreateTemp(storagePath, "crzmp*") defer temp.Close() // wrong scope io.Copy(temp, p) } ```

Each iteration opens a temp file and defers its close. All of them stack up and fire together when `ProcessRequest` returns. 500 parts, 500 fds held simultaneously.

The body size limit (default 128MB) caps total bytes, not part count. A minimal file part (boundary line, `Content-Disposition` with `filename=`, one byte of content) is about 104 bytes. That's roughly 65,000 parts per 6.8MB of body, which on a standard Linux system (hard fd limit 65536) is enough to exhaust the table.

Fix is straightforward: call `temp.Close()` explicitly after `io.Copy` instead of deferring it.

## PoC

Tested on v3.7.0 (`db9850b`), Go 1.25, Linux x86_64.

Add this file at `internal/bodyprocessors/poc_fd_test.go` and run:

```text go test -v -run TestMultipartFDLeak ./internal/bodyprocessors/... ```

```go package bodyprocessors_test

import ( "fmt" "o…

Most recent entries from all

EUVD-2026-385200

fkie_cve-2026-107834

GHSA-rp9v-7xv3-r6g3 — Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor