Undertow Multipart Data Parsing Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Undertow, specifically in its use within WildFly applications. The issue arises when a server receives an HTTP GET request with multipart/form-data content. If the application processes this data using certain parameter-parsing methods, the server inadvertently parses and writes the content to disk before it is needed. This premature handling can cause resource exhaustion, disrupting normal service operations.

Impact

Exploitation of this vulnerability leads to resource exhaustion on the server, causing a denial-of-service condition. The unnecessary parsing and disk storage of multipart data can consume significant CPU and memory resources, potentially causing the application or server to become unresponsive.