Threats Tagged 'cve-2026-107834'

CVE-2026-107834 is a medium severity vulnerability in OWASP Coraza WAF versions 3.0.0 through 3.7.x. It involves uncontrolled resource consumption due to the handling of multipart file uploads, where temporary file descriptors remain open until the entire request completes. An unauthenticated attacker can exploit this by sending many minimal file parts in a multipart request, exhausting the process file descriptor table and causing failures in creating temporary files, blocking legitimate uploads, and preventing the process from opening files or sockets. This issue is fixed in version 3.8.0.

A resource exhaustion vulnerability exists in Coraza v3 multipart body processor due to deferred file handle closures inside a loop. This causes file descriptors to accumulate until the request processing completes, potentially exhausting the file descriptor limit and causing denial of service. The issue affects all v3.x releases before 3.8.0. The vulnerability can trigger false positives in the Core Rule Set (CRS) and block legitimate multipart requests. A patch is available to fix the improper defer usage.