V3: Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling (CVE-2026-41508)

The vulnerability arises from a logic flaw in Coraza's multipart body processor where the io.ErrUnexpectedEOF error is silently ignored without setting the MULTIPART_STRICT_ERROR flag. This error handling was introduced in commit 3347961b to support partial processing of truncated request bodies but inadvertently disables the key multipart strict validation rule (200003). As a result, malformed multipart requests that truncate the body do not trigger the fail-closed defensive rule, allowing evasion of multipart parser inconsistency detection. This can enable attacks such as HTTP request smuggling or payload hiding that rely on parser discrepancies between Coraza and backend parsers. The fix involves setting the MULTIPART_STRICT_ERROR flag even when io.ErrUnexpectedEOF occurs, allowing operators to detect and block such malformed requests.

The impact is that Coraza's recommended multipart strict validation rule (200003) fails to detect and block malformed multipart requests that are truncated prematurely. This disables the primary defense against multipart parser inconsistency evasions, potentially allowing attackers to smuggle additional fields or hide payloads that backend parsers accept but Coraza rejects. While the vulnerability does not directly cause denial of service or data exposure, it undermines a critical defense-in-depth mechanism, increasing the risk of evasion and exploitation of backend multipart parsers.

A patch is available for Coraza versions >=3.4.0 <3.8.0 that restores correct setting of the MULTIPART_STRICT_ERROR flag on truncated multipart bodies. Operators should apply the official fix to ensure rule 200003 functions as intended. Until patched, operators relying on rule 200003 for multipart validation may be vulnerable to evasion via truncated multipart requests. No alternative mitigations are indicated in the advisory; the fix is low-risk and recommended.