CVE-2026-3260
mediumrejectedpriority · track · 0DEEUUSRejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
cvss
Technical severity, 0–10. One row per scoring source.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0830Red Hat Undertow: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-03-23csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Undertow ausnutzen, um einen Denial of Service Angriff durchzuführen.
- GHSA-3x3v-w654-m28mUndertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests2026-03-24ghsa · osvUS
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like `getParameterMap()`, the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3) cnnvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan