CVE-2026-3260: Undertow Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
Summary
CVE-2026-3260: Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests. Affects io.undertow:undertow-core versions < 2.4.0.Beta1. Fixed in 2.4.0.Beta1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Undertow is a flexible and performant web server and servlet container used in Java applications. It supports both blocking and non-blocking APIs, making it suitable for a variety of web applications. However, a vulnerability has been identified in its handling of multipart/form-data content in HTTP GET requests, which can lead to resource exhaustion and Denial of Service (DoS) attacks.
Vulnerability Detail
A flaw exists in Undertow where a remote attacker can exploit the server by sending an HTTP GET request that includes multipart/form-data content. When the application processes parameters using methods like getParameterMap(), the server prematurely parses and stores this content to disk. This behavior can lead to resource exhaustion, potentially resulting in a Denial of Service (DoS) as the server may become unresponsive due to excessive resource consumption.
How To Fix
Latest published version: 2.4.4.Final as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0.Beta1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to reject HTTP GET requests containing multipart/form-data content. This can be done by checking the Content-Type header of incoming requests and rejecting those that do not conform to expected types.
Conclusion
The vulnerability CVE-2026-3260 in Undertow poses a significant risk of Denial of Service through improper handling of multipart/form-data in HTTP GET requests. It is crucial for users to update to the patched version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for io.undertow:undertow-core →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects all versions of Undertow prior to 2.4.0.Beta1.
If exploited, this vulnerability can lead to resource exhaustion, causing the server to become unresponsive and resulting in a Denial of Service (DoS) for users.
Yes, the permanent fix is to update the Undertow package to version 2.4.0.Beta1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for io.undertow:undertow-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
