CVE-2026-3260

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3260", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "REJECTED", "assignerShortName": "redhat", "dateReserved": "2026-02-26T14:22:15.920Z", "datePublished": "2026-03-24T04:11:16.085Z", "dateUpdated": "2026-07-07T19:50:22.087Z", "dateRejected": "2026-07-07T19:50:22.087Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-07T19:50:22.087Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3260", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "REJECTED", "assignerShortName": "redhat", "dateReserved": "2026-02-26T14:22:15.920Z", "datePublished": "2026-03-24T04:11:16.085Z", "dateUpdated": "2026-07-07T19:50:22.087Z", "dateRejected": "2026-07-07T19:50:22.087Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-07T19:50:22.087Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks."}], "id": "CVE-2026-3260", "lastModified": "2026-07-07T21:16:56.140", "metrics": {}, "published": "2026-03-24T05:16:24.073", "references": [], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "undertow: Undertow: Denial of Service due to premature multipart/form-data parsing in GET requests", "id": "2443010", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443010"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like `getParameterMap()`, the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-3260", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "undertow-core", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Fix deferred", "package_name": "undertow-core", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "undertow-core", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "moditect", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "pki-core:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "pki-deps:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "resteasy", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "undertow-core", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "undertow-core", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "org.jberet-jberet-parent", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "org.jboss.eap-jboss-eap-xp", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "undertow-core", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "org.jberet-jberet-parent", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "org.jboss.eap-jboss-eap-xp", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "undertow-core", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Fix deferred", "package_name": "undertow-core", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Fix deferred", "package_name": "undertow-core", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-03-24T04:05:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-3260\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3260"], "statement": "This vulnerability in Undertow, as utilized in Wildfly, allows for premature parsing and storage of multipart/form-data content to disk when an HTTP GET request is received. Exploitation occurs only if the underlying application, such as JSF, explicitly invokes parameter-parsing methods like getParameterMap(). Red Hat products are affected when running applications that meet these specific conditions.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "Red Hat build of Apache Camel - HawtIO 4", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_apache_camel_-_hawtio", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "Red Hat build of Apache Camel for Spring Boot 4", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_apache_camel_for_spring_boot", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Data Grid 8", "source": "cna", "vendor": "Red Hat"}, "product": "data_grid", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Fuse 7", "source": "cna", "vendor": "Red Hat"}, "product": "fuse", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "Red Hat JBoss Enterprise Application Platform 7", "source": "cna", "vendor": "Red Hat"}, "product": "jboss_enterprise_application_platform", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "source": "cna", "vendor": "Red Hat"}, "product": "jboss_enterprise_application_platform_expansion_pack", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "Red Hat Process Automation 7", "source": "cna", "vendor": "Red Hat"}, "product": "process_automation", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "matching"}]}, "original": {"product": "Red Hat Single Sign-On 7", "source": "cna", "vendor": "Red Hat"}, "product": "red_hat_single_sign_on", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 97.0, "source": "matching"}]}, "product": "undertow", "vendor": "redhat"}], "analysis": {"en": {"generated_at": "2026-04-08T20:43:32.736717+00:00", "value": {"mitigation_remediation": ["Check Red\u202fHat\u2019s security advisories for a patch or update that addresses the Undertow multipart\u2011form-data processing flaw.", "If a patch is available, plan and apply it to all affected systems as soon as possible.", "Since no official workaround exists, constrain incoming HTTP traffic by blocking or filtering multipart/form-data GET requests from untrusted networks using a firewall or reverse\u2011proxy.", "Monitor system logs and disk usage for signs of abnormal multipart traffic or resource exhaustion, and adjust the filter thresholds as needed.", "If immediate patching is not feasible, document the risk and review the exposure until a fix is released."], "summary": {"action": "Assess Impact", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected products include Red\u202fHat Data Grid\u202f8, Red\u202fHat Enterprise Linux\u202f10,\u202f8,\u202f9, Red\u202fHat Fuse\u202f7, Red\u202fHat JBoss Enterprise Application Platform\u202f7 and\u202f8 and its Expansion Pack, Red\u202fHat Process Automation\u202f7, Red\u202fHat Single Sign\u2011On\u202f7, and Red\u202fHat builds of Apache\u202fCamel \u2013 HawtIO\u202f4 and Camel for Spring Boot\u202f4. Exact version ranges are not specified in the advisory, but any configuration that incorporates Undertow and processes GET parameters may be susceptible.", "description_and_impact": "This vulnerability exists in the Undertow web server component used by several Red\u202fHat products. A remote attacker can send an HTTP\u202fGET request that includes multipart/form-data components. If the application processes query parameters via methods such as getParameterMap(), Undertow enumerates and writes the multipart data to disk before the request is fully received. This premature parsing causes disk usage to grow and leads to resource exhaustion, resulting in a denial\u2011of\u2011service condition.", "risk_and_exploitability": "The CVSS score is 5.9, indicating moderate severity. The EPSS score is below 1\u202f% and the vulnerability is not listed in the CISA KEV catalogue, suggesting a lower likelihood of widespread exploitation at this time. The attack vector is remote over HTTP; the attacker needs only to craft a multipart/form-data GET request targeting a vulnerable application. Because the flaw can consume disk space rapidly, a successful exploit can degrade or halt service availability, imposing a limited but non\u2011catastrophic impact on affected systems."}}}}, "created": "2026-03-24T10:29:05.387639+00:00", "updated": "2026-04-09T08:29:38.776961+00:00", "vendors": ["redhat", "redhat$PRODUCT$build_of_apache_camel_-_hawtio", "redhat$PRODUCT$build_of_apache_camel_for_spring_boot", "redhat$PRODUCT$data_grid", "redhat$PRODUCT$enterprise_linux", "redhat$PRODUCT$fuse", "redhat$PRODUCT$jboss_enterprise_application_platform", "redhat$PRODUCT$jboss_enterprise_application_platform_expansion_pack", "redhat$PRODUCT$process_automation", "redhat$PRODUCT$red_hat_single_sign_on", "redhat$PRODUCT$undertow"]}