# CVE-2026-3260: Red Hat Undertow resource exhaustion in HTTP request parsing

Source: https://junglewise.ai/threats/cve-2026-3260-red-hat-undertow-resource-exhaustion-in-http-request-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-24. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-3260 · Severity: medium · CVSS 5.9 · Published 2026-03-24

This entry describes a potential resource exhaustion issue in the Undertow web server, which is used to handle web traffic for various Red Hat enterprise products. While initially reported as a vulnerability where large requests could crash the server, it was determined that the software already includes built-in protections that safely drop oversized requests. As a result, the security community has rejected this as a valid vulnerability because the default configuration prevents the described service outage.

Technologies: [io.undertow:undertow-core (Maven)](https://junglewise.ai/threats/technologies/io-undertow-undertow-core), [Red Hat Data Grid 8](https://junglewise.ai/threats/technologies/data-grid-8), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-3260 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3260 being exploited in the wild.

**How severe is CVE-2026-3260?** Medium severity, with a CVSS score of 5.9, published 24 March 2026.

**Which products and versions are affected?** io.undertow:undertow-core (Maven) < 2.4.0.Beta1, ECOSYSTEM:introduced=0.

**Is there a fix for CVE-2026-3260?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-3260 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3260?** Check whether you run io.undertow:undertow-core (Maven), Red Hat Data Grid 8, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reported flaw in Undertow suggested that a remote attacker could cause resource exhaustion by sending HTTP GET requests containing multipart/form-data. The concern was that if an application called methods like getParameterMap(), the server might prematurely parse and store content to disk, leading to a Denial of Service (DoS). However, the CVE was rejected because Undertow enforces a default maximum HTTP request entity size limit. Any request exceeding this configurable limit is safely dropped by the server, preventing single-request Out of Memory (OOM) conditions. Consequently, the vulnerability is considered mitigated by default design.

## Affected products

- Red Hat Undertow All versions prior to rejection fix
- Red Hat JBoss Enterprise Application Platform
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Data Grid 8

## Identifiers

- CVE-2026-3260
- GHSA-3x3v-w654-m28m

## Timeline

- 2026-03-24: disclosed
- 2026-07-07: other: CVE marked as Rejected by the CVE numbering authority

## Related threats

- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)
- [Red Hat PCP privilege escalation in linux_sockets PMDA](https://junglewise.ai/threats/cve-2026-16526-red-hat-pcp-privilege-escalation-in-linux-sockets-pmda)