CVE-2026-41508: Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

Rule 200003 is Coraza’s blanket defense against multipart parser-inconsistency evasions — attack classes where the body is crafted so Coraza’s Go mime/multipart reader and the backend’s multipart parser (PHP, Node, Java, legacy libmodsecurity, etc.) disagree about where fields start or end. The rule fails-closed on any malformed body, so the operator does not need to enumerate every parser-disagreement trick. That defense is now void for any evasion that also truncates the body.

Examples of what becomes reachable:

• Smuggling a second field past the truncation boundary that the backend’s more permissive parser still extracts.
• Hiding payload bytes after a deliberately malformed Content-Disposition header that the Go parser refuses but the backend accepts.
• Generic CRS evasion chains that depend on rule 200003 as a catch-all.

The fix is tiny and low-risk. The impact is disproportionately large because rule 200003 is the only defense-in-depth rule for multipart in the recommended config — there is no secondary signal.