When processing multipart requests, Coraza versions 3.4.0 through 3.8.0 incorrectly treats an io.ErrUnexpectedEOF as a nonfatal event and fails to set the MULTIPART_STRICT_ERROR flag. An attacker can exploit this by sending a truncated multipart body that triggers the unexpected‑EOF error. Because the strict‑error flag is not raised, defensive rules 200002 and 200003 do not fire, which means the malformed payload can be forwarded to the backend server for interpretation, potentially enabling unexpected or malicious processing paths.

This issue affects the OWASP Coraza Web Application Firewall library produced by the corazawaf:coraza vendor. All Coraza releases in the 3.4.0‑3.8.0 range are impacted. Versions prior to 3.4.0 and the 3.8.0 release and later contain the fix and are not vulnerable.

The CVSS score of 5.8 reflects a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation at the time of assessment. The likely attack vector is a remote attacker delivering a specially crafted HTTP request containing a truncated multipart body. While the lack of an explicit error flag limits immediate detection, the impact is that the application may process incomplete or malformed content, potentially leading to unintended behavior or security bypass on the backend.