CVE-2026-3260 in Undertow

Sumário (Inglês)

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like `getParameterMap()`, the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Responsável

redhat

Reservar

26/02/2026

Divulgação

24/03/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
352668	Undertow getParameterMap Negação de Serviço	770	Não definido	Não definido	CVE-2026-3260

Fontes

• MITRE
• NVD
• CVE Details