Vulnerability GHSA-3x3v-w654-m28m
Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
7 months ago
March 24, 2026 at 06:31 AM UTC
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
1.0.0.Alpha1 - 2.4.4.Final
1.0.0.Alpha1 - 2.4.4.Final
Summary
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
Details
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap(), the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-3gv6-g396-9v4r
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-3gv6-g396-9v4r
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-8v4x-mgvp-p658
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-8v4x-mgvp-p658
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-vqqj-9cmv-hx43
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-vqqj-9cmv-hx43
High Risk
9 months ago
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
Critical
10 months ago
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-j382-5jj3-vw4j
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-j382-5jj3-vw4j
Impacted packages
Timeline
Published
7 months ago
March 24, 2026 at 06:31 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC