V3: Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

In Coraza v3 multipart body processor, temporary files are created for each multipart section with their closures deferred inside a loop. Since Go defers execute only at function return, all file descriptors remain open simultaneously during processing, leading to exhaustion of the file descriptor table (EMFILE error) when processing many parts. This triggers the MULTIPART_STRICT_ERROR flag and causes CRS rule 200001 to block requests with HTTP 400 responses, including legitimate ones. The vulnerability affects versions >=3.0.0 and <3.8.0. The fix involves explicitly closing each temporary file immediately after copying its content instead of deferring the close.

No authentication is required to exploit this vulnerability. Any endpoint accepting multipart uploads can be targeted. When the file descriptor limit is exhausted (around 65,000 parts or ~6.8MB body), temporary file creation fails, setting MULTIPART_STRICT_ERROR and causing CRS rule 200001 to block requests with 400 errors. This can lead to denial of service affecting the entire process, as no new files or sockets can be opened while the file descriptor table is full. Legitimate multipart requests may be falsely blocked, causing operational disruption.

A patch is available that fixes the issue by closing temporary files explicitly after copying instead of deferring the close. Users should upgrade to Coraza v3.8.0 or later where this issue is resolved. Until patched, mitigating this vulnerability is difficult as it is inherent to the multipart processor implementation. Monitoring multipart request sizes and counts may help reduce risk but is not a full mitigation.