A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like `getParameterMap()`, the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-3260 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2443010 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Apr 2026, 19:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/security/cve/CVE-2026-3260 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2443010 - Issue Tracking, Vendor Advisory | |
| Summary |
|
|
| CPE | cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:4.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:4.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
|
| First Time |
Redhat fuse
Redhat jboss Enterprise Application Platform Expansion Pack Redhat data Grid Redhat build Of Apache Camel - Hawtio Redhat Redhat process Automation Redhat jboss Enterprise Application Platform Redhat enterprise Linux Redhat single Sign-on Redhat undertow Redhat build Of Apache Camel For Spring Boot |
24 Mar 2026, 05:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-24 05:16
Updated : 2026-04-08 19:11
NVD link : CVE-2026-3260
Mitre link : CVE-2026-3260
CVE.ORG link : CVE-2026-3260
JSON object : View
Products Affected
redhat
- single_sign-on
- build_of_apache_camel_for_spring_boot
- enterprise_linux
- jboss_enterprise_application_platform
- undertow
- build_of_apache_camel_-_hawtio
- jboss_enterprise_application_platform_expansion_pack
- process_automation
- data_grid
- fuse
CWE
CWE-770
Allocation of Resources Without Limits or Throttling