EUVD-2026-14732Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap(), the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).
AnalysisAI
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/form-data content to trigger premature parsing and disk storage of request data, leading to Denial of Service when applications use parameter retrieval methods like getParameterMap(). The vulnerability affects multiple Red Hat products including Enterprise Linux 8, 9, and 10, JBoss Enterprise Application Platform 7 and 8, Red Hat Fuse 7, and several Apache Camel variants. An attacker with network access and no authentication can exhaust server disk resources with moderate attack complexity, causing service unavailability.
Technical ContextAI
The vulnerability resides in Undertow, the Java-based web server component used across Red Hat's enterprise middleware stack. The root cause stems from CWE-770 (Allocation of Resources Without Limits or Throttling), where Undertow prematurely parses and buffers multipart/form-data content to disk without proper resource constraints when an application calls getParameterMap() or similar parameter access methods. This occurs even when such content is semantically invalid in an HTTP GET request, which traditionally should contain only URL-encoded query parameters. The affected products span critical infrastructure components: Red Hat Enterprise Linux 8, 9, and 10 (base operating systems), JBoss Enterprise Application Platform 7 and 8 (application servers), Red Hat Fuse 7 (integration platform), Apache Camel Spring Boot 4 builds, Red Hat Data Grid 8 (caching layer), and Red Hat Single Sign-On 7 (identity management). The Undertow library is a foundational component in the JBoss ecosystem, making this vulnerability broadly impactful across enterprise Java deployments.
RemediationAI
Apply security updates released by Red Hat for affected products immediately, prioritizing critical systems running JBoss Enterprise Application Platform and RHEL deployments. Contact your Red Hat support organization or consult https://access.redhat.com/security/cve/CVE-2026-3260 for version-specific patch availability and errata details. As an interim mitigation before patches are available, implement reverse proxy protections such as request size limits and multipart/form-data rejection for GET requests at the network edge (e.g., nginx or Apache HTTP Server with ModSecurity rules to reject GET requests containing Content-Type: multipart/form-data). Additionally, monitor disk usage on affected systems for anomalies and establish rate limiting on HTTP request processing to prevent rapid resource exhaustion. Configure application-level restrictions to avoid calling getParameterMap() on untrusted request sources where possible, and review custom request handlers for unnecessary parameter parsing.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today