CVE-2026-41508

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.

• CWE-693
• CWE-755

• https://github.com/corazawaf/coraza/commit/f94c81bec209f658120c418448d0590a549b71df
• https://github.com/corazawaf/coraza/releases/tag/v3.8.0
• https://github.com/corazawaf/coraza/security/advisories/GHSA-r3rm-qphw-hh76

Published

Oct 12, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41502BACnet Stack is a BACnet open source protocol stack C librar…7.5
• CVE-2026-41503BACnet Stack is a BACnet open source protocol stack C librar…7.5
• CVE-2026-41504OWASP Coraza WAF is a golang modsecurity compatible web appl…5.8
• CVE-2026-41505RELATE is a web-based courseware package. Prior to commit 2f…8.7
• CVE-2026-41506go-git is an extensible git implementation library written i…7.4
• CVE-2026-41507math-codegen generates code from mathematical expressions. P…9.8
• CVE-2026-41509CROSS implementation contains reference and optimized implem…9.8
• CVE-2026-4151GIMP ANI File Parsing Integer Overflow Remote Code Execution…7.8
• CVE-2026-41510OWASP Coraza WAF is a golang modsecurity compatible web appl…7.2
• CVE-2026-41511OpenMcdf is a fully .NET / C# library to manipulate Compound…5.5
• CVE-2026-41512ai-scanner is an AI model safety scanner built on NVIDIA gar…9.9
• CVE-2026-41513Horilla is an HR and CRM software. In 1.5.0, the notificatio…4.8