CVE-2026-3260

✕ Withdrawn — historical dataMEDIUMNVD 5.9
5.9CVSS

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap(), the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).

CVSS v3
5.9
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

March 24, 2026

Last Modified

April 8, 2026

References (2)

Frequently asked(4)

What is CVE-2026-3260?
CVE-2026-3260 is a rejected CVE ID: its record was withdrawn on July 7, 2026 and no longer describes a vulnerability. Reason given: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
When was the CVE record for CVE-2026-3260 published?
The CVE record for CVE-2026-3260 was published on March 24, 2026. EchelonGraph's copy of the record carries a last-modified date of April 8, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-3260?
CVE-2026-3260 has a CVSS v3 base score of 5.9 (NVD).
How do I remediate CVE-2026-3260?
There is nothing to remediate under CVE-2026-3260: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.