CVE-2026-41508

Received Received - Intake

Truncated Multipart Body Parsing Flaw in OWASP Coraza WAF

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-41508

Affected Vendors & Products

Vendor	Product	Version / Range
corazawaf	coraza	>= 3.4.0, < 3.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-755	The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

Executive Summary

OWASP Coraza WAF is a web application firewall library. Between versions 3.4.0 and 3.8.0, it incorrectly handles truncated multipart HTTP requests by treating parsing errors as nonfatal without triggering strict error signals. This allows attackers to send malformed requests that bypass security rules.

Detection Guidance

This vulnerability can be detected by checking the version of OWASP Coraza WAF in use. If your system runs a version between 3.4.0 and 3.8.0, it is vulnerable. Commands like 'coraza-waf --version' or inspecting package managers (e.g., 'dpkg -l | grep coraza' or 'rpm -qa | grep coraza') can help verify the installed version.

Impact Analysis

An attacker could exploit this to send specially crafted requests that bypass WAF protections, potentially allowing malicious payloads to reach backend systems. This could lead to unauthorized access, data exfiltration, or other attacks depending on the application.

Compliance Impact

This vulnerability could undermine compliance by allowing unauthorized data access or modification if exploited. Organizations using affected versions may fail security audits or violate data protection requirements that mandate proper WAF protections.

Mitigation Strategies

Upgrade OWASP Coraza WAF to version 3.8.0 or later immediately. This version includes the fix for the multipart processor issue. If upgrading is not immediately possible, consider disabling multipart parsing or applying custom rules to detect truncated multipart bodies.

Hi! I’m here to help you understand CVE-2026-41508. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70