CVE-2026-3260
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-3x3v-w654-m28m
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap(), the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).
- Record
GHSA-3x3v-w654-m28m- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE ListNo score
The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
- Record
CVE-2026-3260- Updated
- 2026-11-02
EUVDEUVD-2026-14732
The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
- Record
EUVD-2026-14732- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVDNo score
Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
- Record
CVE-2026-3260- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-3260
- Record
DEBIAN-CVE-2026-3260- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-3x3v-w654-m28m
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap(), the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).
- Record
GHSA-3x3v-w654-m28m- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 13 moreShow less
OSVUBUNTU-CVE-2026-3260
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap(), the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).
- Record
UBUNTU-CVE-2026-3260- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1793728278No score
TuxCare security update for io.undertow:undertow-core (1 CVE)
TuxCare rebuilt io.undertow:undertow-core to address 1 CVE. Fixed in 2.3.20.Final-tuxcare.2.
- Record
CLSA-2026-1793728278- Updated
- 2026-11-04
OSVCLSA-2026-1793853308No score
TuxCare security update for io.undertow:undertow-core (6 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 6 CVEs. Fixed in 1.4.27.Final-tuxcare.3.
- Record
CLSA-2026-1793853308- Updated
- 2026-11-05
OSVCLSA-2026-1794162511No score
TuxCare security update for io.undertow:undertow-core (11 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 11 CVEs. Fixed in 2.0.26.Final-tuxcare.2.
- Record
CLSA-2026-1794162511- Updated
- 2026-11-09
OSVCLSA-2026-1794162761No score
TuxCare security update for io.undertow:undertow-core (3 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 3 CVEs. Fixed in 2.2.37.Final-tuxcare.1.
- Record
CLSA-2026-1794162761- Updated
- 2026-11-09
OSVCLSA-2026-1794235099No score
TuxCare security update for io.undertow:undertow-core (11 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 11 CVEs. Fixed in 2.2.7.Final-tuxcare.1.
- Record
CLSA-2026-1794235099- Updated
- 2026-11-09
OSVCLSA-2026-1794235365No score
TuxCare security update for io.undertow:undertow-core (11 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 11 CVEs. Fixed in 2.1.7.Final-tuxcare.1.
- Record
CLSA-2026-1794235365- Updated
- 2026-11-09
OSVCLSA-2026-1794235562No score
TuxCare security update for io.undertow:undertow-core (10 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 10 CVEs. Fixed in 2.0.32.Final-tuxcare.1.
- Record
CLSA-2026-1794235562- Updated
- 2026-11-09
OSVCLSA-2026-1794235949No score
TuxCare security update for io.undertow:undertow-core (11 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 11 CVEs. Fixed in 2.1.4.Final-tuxcare.1.
- Record
CLSA-2026-1794235949- Updated
- 2026-11-09
OSVCLSA-2026-1794236374No score
TuxCare security update for io.undertow:undertow-core (12 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 12 CVEs. Fixed in 2.2.20.Final-tuxcare.1.
- Record
CLSA-2026-1794236374- Updated
- 2026-11-09
OSVCLSA-2026-1794236816No score
TuxCare security update for io.undertow:undertow-core (11 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 11 CVEs. Fixed in 2.2.17.Final-tuxcare.1.
- Record
CLSA-2026-1794236816- Updated
- 2026-11-09
OSVCLSA-2026-1794246287No score
TuxCare security update for io.undertow:undertow-core (5 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 5 CVEs. Fixed in 2.2.24.Final-tuxcare.2.
- Record
CLSA-2026-1794246287- Updated
- 2026-11-10
OSVCLSA-2026-1794246653No score
TuxCare security update for io.undertow:undertow-core (11 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 11 CVEs. Fixed in 2.2.28.Final-tuxcare.1.
- Record
CLSA-2026-1794246653- Updated
- 2026-11-10
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.undertow:undertow-coreMaven | before 2.4.0.Beta1 | 2.4.0.Beta1 |
io.undertow:undertow-coreTuxCare:Maven | 2.3.20.Final up to 2.3.20.Final-tuxcare.2, plus listed versions 2.3.20.Final-tuxcare.1 | 2.3.20.Final-tuxcare.2 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 6 CVEs | 1.4.27.Final up to 1.4.27.Final-tuxcare.3, plus listed versions 1.4.27.Final-tuxcare.11.4.27.Final-tuxcare.2 | 1.4.27.Final-tuxcare.3 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 11 CVEs | 2.0.26.Final up to 2.0.26.Final-tuxcare.2, plus listed versions 2.0.26.Final-tuxcare.1 | 2.0.26.Final-tuxcare.2 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 3 CVEs | 2.2.37.Final up to 2.2.37.Final-tuxcare.1 | 2.2.37.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 11 CVEs | 2.2.7.Final up to 2.2.7.Final-tuxcare.1 | 2.2.7.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 11 CVEs | 2.1.7.Final up to 2.1.7.Final-tuxcare.1 | 2.1.7.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 10 CVEs | 2.0.32.Final up to 2.0.32.Final-tuxcare.1 | 2.0.32.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 11 CVEs | 2.1.4.Final up to 2.1.4.Final-tuxcare.1 | 2.1.4.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 12 CVEs | 2.2.20.Final up to 2.2.20.Final-tuxcare.1 | 2.2.20.Final-tuxcare.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 11 CVEs | 2.2.17.Final up to 2.2.17.Final-tuxcare.1 | 2.2.17.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 5 CVEs | 2.2.24.Final up to 2.2.24.Final-tuxcare.2, plus listed versions 2.2.24.Final-tuxcare.1 | 2.2.24.Final-tuxcare.2 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 11 CVEs | 2.2.28.Final up to 2.2.28.Final-tuxcare.1 | 2.2.28.Final-tuxcare.1 |
io.undertow:undertow-coreMaven | All versions, plus listed versions 1.0.0.Alpha11.0.0.Alpha101.0.0.Alpha111.0.0.Alpha121.0.0.Alpha13 Show 45 moreShow less1.0.0.Alpha141.0.0.Alpha151.0.0.Alpha161.0.0.Alpha171.0.0.Alpha181.0.0.Alpha191.0.0.Alpha21.0.0.Alpha201.0.0.Alpha211.0.0.Alpha221.0.0.Alpha31.0.0.Alpha41.0.0.Alpha51.0.0.Alpha61.0.0.Alpha71.0.0.Alpha81.0.0.Alpha91.0.0.Beta11.0.0.Beta101.0.0.Beta111.0.0.Beta121.0.0.Beta131.0.0.Beta141.0.0.Beta151.0.0.Beta161.0.0.Beta171.0.0.Beta181.0.0.Beta191.0.0.Beta21.0.0.Beta201.0.0.Beta211.0.0.Beta221.0.0.Beta231.0.0.Beta241.0.0.Beta251.0.0.Beta261.0.0.Beta271.0.0.Beta281.0.0.Beta291.0.0.Beta31.0.0.Beta301.0.0.Beta311.0.0.Beta321.0.0.Beta331.0.0.Beta4 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected | ||
| affected, aliases | OSV | |
| affected, aliases, facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-3260 has been rejected by its source and should not be treated as a live vulnerability, published March 24, 2026. Fixed in io.undertow:undertow-core 2.4.0.Beta1.
References
nvd.nist.gov/vuln/detail/CVE-2026-3260
access.redhat.com/security/cve/CVE-2026-3260
bugzilla.redhat.com/show_bug.cgi?id=2443010
github.com/advisories/GHSA-3x3v-w654-m28m
security-tracker.debian.org/tracker/CVE-2026-3260
ubuntu.com/security/CVE-2026-3260
cve.org/CVERecord?id=CVE-2026-3260
Left out here: 300 versions. The JSON record has them.