There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers, which could use up memory resources to cause a Denial of Service.
We have a max header config in Undertow that cna be used to limit the amount of continuatoin frames, but it is not being enforced by default.