Log in Start free

Vulnerability · Published Oct 9, 2026 · Assigned by GitHub_M

CVE-2026-107834OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in coraza from corazawaf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 74.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/corazawaf/corazano fix listedGO-2026-6697
Gogithub.com/corazawaf/coraza/v2no fix listedGO-2026-6697
Gogithub.com/corazawaf/coraza/v33.8.0GHSA-rp9v-7xv3-r6g3
Gogithub.com/corazawaf/coraza/v33.8.0GO-2026-6697

Affected products (as reported)

VendorProductVersions
corazawaf coraza >= 3.0.0, < 3.8.0

Weakness: CWE-400, CWE-772 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References