Moderate severityNVD Advisory· Published Mar 24, 2026· Updated Jul 7, 2026

CVE-2026-3260

Description

Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.undertow:undertow-coreMaven	>= 0	—

Affected products

osv-coords5 versions
pkg:apk/chainguard/wildfly-openjdk-17 pkg:apk/chainguard/wildfly-openjdk-21 pkg:apk/wolfi/wildfly-openjdk-17 pkg:apk/wolfi/wildfly-openjdk-21 pkg:maven/io.undertow/undertow-core
< 40.0.0-r0+ 4 more
- (no CPE)range: < 40.0.0-r0
- (no CPE)range: < 40.0.0-r0
- (no CPE)range: < 40.0.0-r0
- (no CPE)range: < 40.0.0-r0
- (no CPE)range: < 2.4.0.Beta1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-3x3v-w654-m28mghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-3260ghsaADVISORY
access.redhat.com/security/cve/CVE-2026-3260ghsaWEB
bugzilla.redhat.com/show_bug.cgighsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000