Coraza skipped body parsing for unusual Content-Type values; a Claude-co-authored 3.8.0 fix handled parameters but not duplicate headers or leading whitespace, which hid form fields until 3.8.1.

@@ -385,7 +385,7 @@ func (tx *Transaction) AddRequestHeader(key string, value string) { 	switch keyl { 	case "content-type": 		val := strings.ToLower(value)-		if val == "application/x-www-form-urlencoded" {+		if strings.HasPrefix(val, "application/x-www-form-urlencoded") { 			tx.variables.reqbodyProcessor.Set("URLENCODED") 		} else if strings.HasPrefix(val, "multipart/form-data") { 			tx.variables.reqbodyProcessor.Set("MULTIPART")

@@ -402,7 +402,13 @@ func (tx *Transaction) AddRequestHeader(key string, value string) { 		// which body the backend parses -- see GHSA-w253-m66g-rx24. The header 		// was added above, so a count of 1 means this is the first one. 		if len(tx.variables.requestHeaders.Get("content-type")) == 1 {-			val := strings.ToLower(value)+			// Trimmed the way mime.ParseMediaType trims the media type, which+			// a typical backend uses to pick its own parser: TrimSpace strips+			// Unicode whitespace (U+0085, U+00A0, U+3000, ...) that net/http+			// accepts in header values. Without it, a leading Unicode space+			// skips body processing here while the backend still parses the+			// body.+			val := strings.TrimSpace(strings.ToLower(value)) 			if strings.HasPrefix(val, "application/x-www-form-urlencoded") { 				tx.variables.reqbodyProcessor.Set("URLENCODED") 			} else if strings.HasPrefix(val, "multipart/form-data") {