CVE-2026-41508 Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling
Remote attackers can bypass WAF multipart inspection rules by sending truncated bodies, allowing malicious payloads to reach backend servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41508?
CVE-2026-41508 is a medium-severity vulnerability in corazawaf coraza, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.
Which versions are affected by CVE-2026-41508?
5 open source packages ship an affected version, including github.com/corazawaf/coraza/v3, github.com/corazawaf/coraza and github.com/corazawaf/coraza/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/corazawaf/coraza/v3 Go | From 3.4.0 | 3.8.0 |
github.com/corazawaf/coraza/v3 Go | From 3.4.0 | 3.8.0 |
github.com/corazawaf/coraza/v3 Go | From 3.4.0 | 3.8.0 |
github.com/corazawaf/coraza Go | All versions | None |
github.com/corazawaf/coraza/v2 Go | All versions | None |
How do I fix CVE-2026-41508?
Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.
Is CVE-2026-41508 being exploited?
There is no known exploitation of CVE-2026-41508 in the wild and no public exploit code.
Sources
Also known as GHSA-r3rm-qphw-hh76, GO-2026-6670.