CVE-2026-41508 Details
Description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.
A vulnerability exists in the OWASP Coraza WAF multipart body processor, specifically in versions 3.4.0 prior to 3.8.0. The issue arises because the processor incorrectly treats 'io.ErrUnexpectedEOF' as a non-fatal error, failing to activate the 'MULTIPART_STRICT_ERROR' flag. This oversight allows remote attackers to send truncated multipart bodies that are not properly validated, bypassing essential defensive rules. As a result, payloads exploiting this parser inconsistency can reach backend applications that interpret the incomplete data in a way that could be harmful.
Users can upgrade to OWASP Coraza WAF version 3.8.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/corazawaf/coraza/commit/f94c81bec209f658120c418448d0590a549b71df | [email protected] | Source CodeVendor |
| https://github.com/corazawaf/coraza/releases/tag/v3.8.0 | [email protected] | AdvisoryBundleRelease NotesVendor |
| https://github.com/corazawaf/coraza/security/advisories/GHSA-r3rm-qphw-hh76 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OWASP Coraza WAF | >= 3.4.0, <= 3.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |