CVE-2026-3260: Undertow: undertow: denial of service due to premature multipart/form-data parsing in get requests
A vulnerability was identified in Undertow (as used in Wildfly) where the server prematurely parses and stores multipart/form-data content to the disk when receiving an HTTP GET request, provided the underlying application (e.g., JSF) invokes parameter-parsing methods like getParameterMap().
Other sources
Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure Undertow’s maximum HTTP request entity size limit to prevent multipart/form-data bodies from being prematurely stored to disk; ensure requests with bodies exceeding the configured limit are dropped (covers GET/HEAD requests with a body).
Undertow (as used in Wildfly) configurable maximum HTTP request entity size limit = Set/keep the limit so that any request with a body exceeding it is safely dropped