https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:37:42 +0000 https://vulnerability.circl.lu/vuln/ghsa-r3rm-qphw-hh76 <p><strong>Affected:</strong> Go: github.com/corazawaf/coraza/v3</p> <p>## Root Cause</p> <p>File: `internal/bodyprocessors/multipart.go` (since commit `3347961b`, PR #1453 *&#34;feat: ignore unexpected EOF in MIME multipart request body processor&#34;*, merged 2026-03-06, first shipped in `v3.4.0`).</p> <p>The multipart body processor treats `io.ErrUnexpectedEOF` as a benign condition. Three sites are affected; all mishandle the error the same way.</p> <p>### File branch, filesystem-backed (lines 71–77)</p> <p>```go sz, err := io.Copy(temp, p) if err != nil { if !errors.Is(err, io.ErrUnexpectedEOF) { v.MultipartStrictError().(*collections.Single).Set(&#34;1&#34;) return err } seenUnexpectedEOF = true // &lt;-- flag never set for UnexpectedEOF } ```</p> <p>### File branch, TinyGo path (lines 82–88)</p> <p>```go sz, err := io.Copy(io.Discard, p) if err != nil { if !errors.Is(err, io.ErrUnexpectedEOF) { v.MultipartStrictError().(*collections.Single).Set(&#34;1&#34;) return err } seenUnexpectedEOF = true // &lt;-- same gap } ```</p> <p>### Field branch (lines 102–113)</p> <p>```go data, err := io.ReadAll(p) if err != nil { if !errors.Is(err, io.ErrUnexpectedEOF) { v.MultipartStrictError().(*collections.Single).Set(&#34;1&#34;) return err } } ... if errors.Is(err, io.ErrUnexpectedEOF) { break // &lt;-- exits loop with no flag set } ```</p> <p>The function then returns `nil` at line 116 for any body that ended prematurely. Consequences:</p> <p>1. `MULTIPART_STRICT_ERROR` stays at its initial value `0`. 2. `REQBODY_ERROR` is not propaga…</p> <p><strong>Affected:</strong> Go: github.com/corazawaf/coraza/v3</p> <p>## Root Cause</p> <p>File: `internal/bodyprocessors/multipart.go` (since commit `3347961b`, PR #1453 *&#34;feat: ignore unexpected EOF in MIME multipart request body processor&#34;*, merged 2026-03-06, first shipped in `v3.4.0`).</p> <p>The multipart body processor treats `io.ErrUnexpectedEOF` as a benign condition. Three sites are affected; all mishandle the error the same way.</p> <p>### File branch, filesystem-backed (lines 71–77)</p> <p>```go sz, err := io.Copy(temp, p) if err != nil { if !errors.Is(err, io.ErrUnexpectedEOF) { v.MultipartStrictError().(*collections.Single).Set(&#34;1&#34;) return err } seenUnexpectedEOF = true // &lt;-- flag never set for UnexpectedEOF } ```</p> <p>### File branch, TinyGo path (lines 82–88)</p> <p>```go sz, err := io.Copy(io.Discard, p) if err != nil { if !errors.Is(err, io.ErrUnexpectedEOF) { v.MultipartStrictError().(*collections.Single).Set(&#34;1&#34;) return err } seenUnexpectedEOF = true // &lt;-- same gap } ```</p> <p>### Field branch (lines 102–113)</p> <p>```go data, err := io.ReadAll(p) if err != nil { if !errors.Is(err, io.ErrUnexpectedEOF) { v.MultipartStrictError().(*collections.Single).Set(&#34;1&#34;) return err } } ... if errors.Is(err, io.ErrUnexpectedEOF) { break // &lt;-- exits loop with no flag set } ```</p> <p>The function then returns `nil` at line 116 for any body that ended prematurely. Consequences:</p> <p>1. `MULTIPART_STRICT_ERROR` stays at its initial value `0`. 2. `REQBODY_ERROR` is not propaga…</p> https://vulnerability.circl.lu/vuln/ghsa-r3rm-qphw-hh76