CVE-2026-107834

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.

• CWE-400
• CWE-772

• https://github.com/corazawaf/coraza/commit/1bc39036e99c88e7de60cf8e6bb55ee4c311223c
• https://github.com/corazawaf/coraza/releases/tag/v3.8.0
• https://github.com/corazawaf/coraza/security/advisories/GHSA-rp9v-7xv3-r6g3

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107828Jivejdon through 5.0 contains an authentication bypass vulne…6.5
• CVE-2026-107829Jivejdon through 5.0 contains a weak password storage vulner…5.9
• CVE-2026-10783A security flaw has been discovered in gradio-app gradio 6.1…2.5
• CVE-2026-107830Jivejdon from commit e0306088 through commit ee67a65e lacks …5.3
• CVE-2026-107831Jivejdon through 5.0 contains a cross-site request forgery v…4.3
• CVE-2026-107833OWASP Coraza WAF is a golang modsecurity compatible web appl…5.9
• CVE-2026-107835OWASP Coraza WAF is a golang modsecurity compatible web appl…4
• CVE-2026-107836RIOT is an open-source microcontroller operating system desi…7.1
• CVE-2026-107837RIOT is an open-source microcontroller operating system desi…8.2
• CVE-2026-107838RIOT is an open-source microcontroller operating system desi…7.5
• CVE-2026-107839ageLANServer provides a cross-platform web server and launch…7.5
• CVE-2026-107840yopass is a service for securely sharing secrets, passwords,…7.5