CVE-2026-3260: Red Hat Undertow resource exhaustion in HTTP request parsing

CVE-2026-3260 · Severity: medium · CVSS 5.9 · Published 2026-03-24

This entry describes a potential resource exhaustion issue in the Undertow web server, which is used to handle web traffic for various Red Hat enterprise products. While initially reported as a vulnerability where large requests could crash the server, it was determined that the software already includes built-in protections that safely drop oversized requests. As a result, the security community has rejected this as a valid vulnerability because the default configuration prevents the described service outage.

Technologies: io.undertow:undertow-core (Maven), Red Hat Data Grid 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-3260 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3260 being exploited in the wild.
How severe is CVE-2026-3260?
Medium severity, with a CVSS score of 5.9, published 24 March 2026.
Which products and versions are affected?
io.undertow:undertow-core (Maven) < 2.4.0.Beta1, ECOSYSTEM:introduced=0.
Is there a fix for CVE-2026-3260?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3260 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-3260?
Check whether you run io.undertow:undertow-core (Maven), Red Hat Data Grid 8, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reported flaw in Undertow suggested that a remote attacker could cause resource exhaustion by sending HTTP GET requests containing multipart/form-data. The concern was that if an application called methods like getParameterMap(), the server might prematurely parse and store content to disk, leading to a Denial of Service (DoS). However, the CVE was rejected because Undertow enforces a default maximum HTTP request entity size limit. Any request exceeding this configurable limit is safely dropped by the server, preventing single-request Out of Memory (OOM) conditions. Consequently, the vulnerability is considered mitigated by default design.

Affected products

  • Red Hat Undertow All versions prior to rejection fix
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Data Grid 8

Identifiers

  • CVE-2026-3260
  • GHSA-3x3v-w654-m28m

Timeline

  • 2026-03-24: disclosed
  • 2026-07-07: other: CVE marked as Rejected by the CVE numbering authority

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.