Vulnerability GHSA-3x3v-w654-m28m

Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
7 months ago
March 24, 2026 at 06:31 AM UTC
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
1.0.0.Alpha1 - 2.4.4.Final
1.0.0.Alpha1 - 2.4.4.Final

Summary

Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests

Details

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap(), the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).

Impacted packages

Timeline

Published
7 months ago
March 24, 2026 at 06:31 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC