CVE-2026-101021
7.5HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-407
Impact
Remote unauthenticated attackers can cause denial of service by exhausting CPU and memory via crafted multipart HTTP requests. They only need network access to an endpoint parsing multipart inputs.
Root cause
MultipartInputStream implements inefficient boundary matching and performs redundant buffer copies during input processing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the patched component version once published by the vendor, or place a web application firewall or reverse proxy in front to drop or limit oversized and abnormally structured multipart request bodies.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.