CVE-2026-107834: CWE-400: Uncontrolled Resource Consumption in corazawaf coraza

The vulnerability in Coraza WAF (versions >=3.0.0 <3.8.0) arises from the multipart loop in internal/bodyprocessors/multipart.go, which defers closing temporary files for each uploaded file part until the full request returns. This leads to accumulation of open file descriptors during request processing. An attacker can exploit this by submitting a multipart request with many minimal file parts, exhausting the file descriptor limit within the request-body size constraints. The result is os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and a process-wide inability to open files or sockets. The issue is addressed by closing temporary files earlier in version 3.8.0.

The vulnerability allows an unauthenticated attacker to cause denial of service by exhausting the process's file descriptor table. This leads to failures in creating temporary files, errors in multipart processing, blocking of legitimate uploads, and inability for the process to open files or network sockets, potentially disrupting service availability. There is no impact on confidentiality or integrity.

Upgrade Coraza WAF to version 3.8.0 or later, where this issue is fixed. There are no vendor advisories indicating alternative mitigations or that no action is required.