Executive brief
This entry describes a potential resource exhaustion issue in the Undertow web server, which is used to handle web traffic for various Red Hat enterprise products. While initially reported as a vulnerability where large requests could crash the server, it was determined that the software already includes built-in protections that safely drop oversized requests. As a result, the security community has rejected this as a valid vulnerability because the default configuration prevents the described service outage.
Technical details
A reported flaw in Undertow suggested that a remote attacker could cause resource exhaustion by sending HTTP GET requests containing multipart/form-data. The concern was that if an application called methods like getParameterMap(), the server might prematurely parse and store content to disk, leading to a Denial of Service (DoS). However, the CVE was rejected because Undertow enforces a default maximum HTTP request entity size limit. Any request exceeding this configurable limit is safely dropped by the server, preventing single-request Out of Memory (OOM) conditions. Consequently, the vulnerability is considered mitigated by default design.
Affected products
- Red Hat Undertow All versions prior to rejection fix
- Red Hat JBoss Enterprise Application Platform
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Data Grid 8
Timeline
- 2026-03-24: disclosed
- 2026-07-07: other: CVE marked as Rejected by the CVE numbering authority