This vulnerability exists in the Undertow web server component used by several Red Hat products. A remote attacker can send an HTTP GET request that includes multipart/form-data components. If the application processes query parameters via methods such as getParameterMap(), Undertow enumerates and writes the multipart data to disk before the request is fully received. This premature parsing causes disk usage to grow and leads to resource exhaustion, resulting in a denial‑of‑service condition.

Affected products include Red Hat Data Grid 8, Red Hat Enterprise Linux 10, 8, 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8 and its Expansion Pack, Red Hat Process Automation 7, Red Hat Single Sign‑On 7, and Red Hat builds of Apache Camel – HawtIO 4 and Camel for Spring Boot 4. Exact version ranges are not specified in the advisory, but any configuration that incorporates Undertow and processes GET parameters may be susceptible.

The CVSS score is 5.9, indicating moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalogue, suggesting a lower likelihood of widespread exploitation at this time. The attack vector is remote over HTTP; the attacker needs only to craft a multipart/form-data GET request targeting a vulnerable application. Because the flaw can consume disk space rapidly, a successful exploit can degrade or halt service availability, imposing a limited but non‑catastrophic impact on affected systems.