Skip to content
fr Sign in
5.9 Medium

CVE-2026-3260 A flaw was found in Undertow

Description

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like `getParameterMap()`, the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Show the 3 other branches
Product Affected versions Fixed in
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Single Sign-On 7 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat build of Apache Camel for Spring Boot 4

The 106 CVEs of Red Hat build of Apache Camel for Spring Boot 4 →
CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow 6.5 Medium CVE-2026-114370 A flaw was found in the PathResourceManager component of the Undertow web server 3.7 Low CVE-2026-93562 A flaw was found in Netty's HTTP/1 decoder 6.5 Medium CVE-2026-93574 A flaw was found in Netty's `netty-codec-http` component 6.5 Medium
Track this CVE