Skip to content
Sign in
5.9 Medium

CVE-2026-3260 A flaw was found in Undertow

Description

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like `getParameterMap()`, the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Show the 3 other branches
Product Affected versions Fixed in
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Single Sign-On 7 Versions not published

Other CVEs of Red Hat build of Apache Camel for Spring Boot 4

The 106 CVEs of Red Hat build of Apache Camel for Spring Boot 4 →
CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow 6.5 Medium CVE-2026-114370 Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal 3.7 Low CVE-2026-93562 Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling 6.5 Medium CVE-2026-93574 Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing 6.5 Medium
Track this CVE