CVE-2026-107835

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in the multipart loop in internal/bodyprocessors/multipart.go that executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in ProcessResponse in internal/bodyprocessors/json.go that passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. This issue is fixed in version 3.8.0.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in ProcessURI in internal/corazawaf/transaction.go that handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. This issue is fixed in version 3.8.0.

OWASP Coraza WAF, a modsecurity compatible web application firewall library, crashes due to misuse of `log.Fatalf`. The application crashes immediately after receiving crafted requests from attackers, triggered by an error in `mime.ParseMediaType`.