Red Hat Enterprise Linux 10 CVE-2026-3260

The CVSS v3.1 score of 5.9 reflects a network-exploitable vulnerability with moderate attack complexity and no authentication requirements, resulting in high availability impact. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates the attack requires specific conditions (high complexity) but can be executed remotely without privileges or user interaction. The moderate CVSS score masks meaningful real-world risk because exploitation is automatable and requires only network access—an attacker can craft malformed requests programmatically and scale attacks across multiple targets. While the CVSS complexity is rated high, this likely reflects the dependency on application-level behavior (calling getParameterMap) rather than network-layer difficulty; once an application is identified as vulnerable, exploitation becomes straightforward. The broad CPE coverage across Red Hat's entire enterprise portfolio (RHEL 8/9/10, EAP 7/8, Fuse, Camel, Data Grid, SSO) indicates this is a critical infrastructure risk affecting mission-critical systems. The lack of confidentiality or integrity impact limits severity, but the absolute Denial of Service potential against core middleware makes this a priority for enterprises. Real-world risk is elevated due to the ease of automation, lack of user interaction required, and ubiquity of affected products in enterprise environments.

An attacker crafts a Python or shell script that sends HTTP GET requests to a target Red Hat JBoss or Camel endpoint with a Content-Type: multipart/form-data header and large binary payloads in the request body. Each request triggers Undertow to parse and buffer the multipart content to disk. When the target application calls getParameterMap() during request processing, the buffered data is instantiated, consuming additional memory and disk I/O. By sending hundreds or thousands of such requests in rapid succession from multiple source IPs, the attacker exhausts the server's disk space or I/O capacity, rendering the application unavailable. Attack complexity is moderate because the attacker must identify an endpoint that triggers parameter parsing, but once discovered, the attack scales automatically without further interaction or special credentials.