PHP "RCE via OOM corruption" (GHSA-w8hw-w9fx-j79w) and the session
upload-progress variant (GHSA-6wmf-4rv5-p3rp), interim until patched PHP is
on every customer image.
HAProxy (hap_listener.tpl, every frontend render, WAF on or off):
deny 400 multipart/form-data with no Content-Length (HTTP/1.1 chunked,
HTTP/2-3 streamed bodies) -- vector (a), the post_max_size bypass.
Measured: Chrome 155 (h2 and h3) and Firefox 153 send content-length on
form submits, FormData fetch and XHR; only a ReadableStream fetch body
(duplex:'half') has none.
Coraza (coraza-spoa/overrides.conf, 209610-209616):
209610 ARGS_NAMES/FILES_NAMES with more than 16 '['
209611-613 part-header budget (4/part, deny 32 below zero)
209614-615 more than 64 empty-filename file parts
209616 multipart PHP_SESSION_UPLOAD_PROGRESS field
Ids sit in the engine range 200000-209999 that WHP's break-glass rule
(991000001) already removes, so no WHP release is needed for break-glass
to lift them. Each flips the engine On for itself, like the day-one
promotions, so they deny in every mode the sidecar runs in.
Limitation: Coraza sees only the first 16 KB of a body.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
