CoreHTTP v3.8.0 Advisory: CVE-2026-41504/508, Log Injection, DoS, and FD Leak

Vulnerability Overview Version 3.8.0 contains multiple security vulnerabilities, primarily involving logging, multipart data processing, JSON response body handling, multipart processors, and URI parsing. Scope of Impact GHSA-gprw-wwv7-xjir (CVE-2026-41504): Affects versions 3.0.0 - 3.7.0 GHSA-3rm-gphw-hh76 (CVE-2026-41508): Affects versions 3.4.0 - 3.7.0 GHSA-p45q-qfsp-ggqv: Affects versions 3.0.0 - 3.7.0 GHSA-3c6w-9xmx-8h2h: Affects versions 3.0.0 - 3.7.0 GHSA-rp9v-7xv3-r5q3: Affects versions 3.0.0 - 3.7.0 GHSA-x26q-whqp-fh4m: Affects versions 3.0.0 - 3.7.0 Remediation 1. GHSA-gprw-wwv7-xjir (CVE-2026-41504): - Issue: The native audit log format did not escape CR/LF characters when writing request and response data, leading to log injection. - Fix: Escape CR/LF characters. 2. GHSA-3rm-gphw-hh76 (CVE-2026-41508): - Issue: Truncated multipart bodies did not set , causing rule 200003 to not trigger. - Fix: Set . 3. GHSA-p45q-qfsp-ggqv: - Issue: In , each octal escape character was converted to a null byte, allowing octal-encoded payloads to bypass rules. - Fix: Correctly handle octal escape characters. 4. GHSA-3c6w-9xmx-8h2h: - Issue: The JSON response body processor lacks a recursion limit, potentially causing deep nested responses to tie up the core for several seconds. - Fix: Add a recursion limit. 5. GHSA-rp9v-7xv3-r5q3: - Issue: The multipart processor retains a file descriptor for each file part until the request completes, which could lead to file descriptor table exhaustion. - Fix: Close file descriptors promptly. 6. GHSA-x26q-whqp-fh4m: - Issue: When a request URI cannot be parsed, and are left empty, affecting integrations that do not use . - Fix: Properly handle URI parsing failures. Code Block No specific POC code or exploit code is included in the page. Summary Multiple security vulnerabilities exist in version 3.8.0, affecting versions 3.0.0 - 3.7.0. Key issues include log injection, improper multipart data processing, lack of recursion limits in JSON response body handling, file descriptor leaks, and URI parsing failures. Remediation measures include escaping CR/LF characters, setting , correctly handling octal escape characters, adding recursion limits, closing file descriptors promptly, and properly handling URI parsing failures.

Goal Reached Thanks to every supporter — we hit 100%!

CoreHTTP v3.8.0 Advisory: CVE-2026-41504/508, Log Injection, DoS, and FD Leak

More from this source