CVE-2026-107834

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.0.0 through 3.7.0

Description An unauthenticated attacker can cause a denial of service by submitting a multipart request body containing a large number of minimal file parts. The issue occurs because the multipart processor in internal/bodyprocessors/multipart.go uses defer temp.Close() inside a loop. In Go, deferred functions execute when the surrounding function returns rather than when the loop iteration ends, causing every temporary file descriptor to remain open until ProcessRequest() exits.

This behavior can exhaust the process file-descriptor table (reaching EMFILE) even within the default request-body size limit. For example, approximately 65,000 minimal parts can fit within 6.8MB of data, which is sufficient to exhaust the file-descriptor limit on standard Linux systems. This leads to os.CreateTemp failures, the triggering of MULTIPART STRICT ERROR, and the blocking of legitimate uploads. Furthermore, it causes a process-wide inability to open new files or sockets.

Recommendations Update OWASP Coraza WAF to version 3.8.0.