CVE-2026-3260

{"id": "CVE-2026-3260", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2026-03-24T05:16:24.073", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-3260", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443010", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like `getParameterMap()`, the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS)."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Undertow. Un atacante remoto podr\u00eda explotar esta vulnerabilidad enviando una solicitud HTTP GET que contenga contenido multipart/form-data. Si la aplicaci\u00f3n subyacente procesa par\u00e1metros utilizando m\u00e9todos como 'getParameterMap()', el servidor analiza y almacena prematuramente este contenido en el disco. Esto podr\u00eda llevar al agotamiento de recursos, lo que podr\u00eda resultar en una denegaci\u00f3n de servicio (DoS)."}], "lastModified": "2026-03-24T15:53:48.067", "sourceIdentifier": "secalert@redhat.com"}