CVE-2026-107834mediumCWE-400CWE-772

CVE-2026-107834: fallo de gravedad media en corazawaf coraza

OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear coraza+ Monitorear github.com/corazawaf/coraza/v2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
corazawaf · coraza
CVEs relacionadas — corazawaf coraza

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-40586HIGHgo package github.com/corazawaf/coraza is vulnerable to denial of serviceEPSS 0.7%CVE-2026-41508MEDIUMOWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingEPSS 0.5%CVE-2026-107826HIGHOWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)EPSS 0.5%CVE-2026-107833MEDIUMOWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustionEPSS 0.4%CVE-2026-41510HIGHOWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingEPSS 0.4%CVE-2026-41504MEDIUMOWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsEPSS 0.4%