OWASP Coraza WAF EUVD-2026-95927

Exploitation requires that the target application run a vulnerable Coraza version (3.0.0 through 3.7.x) with multipart request-body inspection active (the default path for multipart/form-data bodies) and with filesystem-backed temporary storage available for part data (os.CreateTemp in a storage path). The default 128MB body-size limit caps bytes but not part count, so a ~6.8MB body of ~65,000 minimal ~104-byte file parts suffices to reach the Linux default hard limit of 65536 descriptors. No authentication is required (PR:N) and no user interaction (UI:N). Limiting factors: the leak is transient - descriptors free when the request returns, so sustained denial needs repeated/concurrent flooding; the triggering threshold depends on the process's configured fd ulimit; and only deployments that actually inspect multipart bodies and have filesystem access are affected. Fixed versions (3.8.0+) are not exploitable.

Signals are mostly consistent and point to a moderate, non-emergency availability issue. The input CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly reflects a network-reachable, low-complexity, unauthenticated bug with no confidentiality or integrity impact. KEV status is NOT present (no confirmed active exploitation) and no EPSS or SSVC decision data was supplied, so probabilistic and decision-framework inputs are simply missing rather than conflicting. A working proof-of-concept IS present inside the GHSA advisory (a Go test that measures open file descriptors), so publicly available exploit code exists, but POC availability must not be conflated with in-the-wild use. The main point of divergence is impact magnitude: the description states the condition causes 'process-wide inability to open files or sockets' and blocks all legitimate uploads, which is arguably a total (A:H) availability loss during a sustained flood rather than the partial A:L chosen by the input - this is noted but not asserted as fact. Mitigating the urgency, the leaked descriptors are released when ProcessRequest() returns, so a single request is self-healing and denial requires continuous flooding. Net: a real priority for internet-facing WAF deployments because a web application firewall failing is the failure of a security control, but not a drop-everything emergency given DoS-only impact and no evidence of exploitation.

An internet-facing service that embeds Coraza (for example behind a Go reverse proxy inspecting multipart/form-data) accepts file uploads. An unauthenticated attacker sends a single ~7MB multipart body containing roughly 65,000 minimal file parts; Coraza opens a temporary file per part and defers closing each descriptor until the whole request returns, exhausting the process file-descriptor table (EMFILE) and blocking the server from opening further files or sockets. A functional PoC test is published in the GHSA advisory.