-
Bug
-
Resolution: Done
-
Major
-
None
-
None
-
None
When the UndertowOption.MULTIPART_MAX_ENTITY_SIZE is set to -1, the MultiPartParserDefinition sets the new entity size limit in the exchange.
Even though this seems to be correct at first glance, this has the collateral effect of overwriting the entity size in the exchange request. The reason for this is that the MultipartParserDefinition.create(HttpServerExchange) kicks in after the request is parsed and the entity size is read. So, if a request comes in saying that the entity size is X, but the MULTIPART_MAX_ENTITY_SIZE option is configured to be -1, the effect is the same of receiving a malformed request stating that the entity size is -1, as X will be overwritten with the value of -1 by MultiPartParserDefinition.
- duplicates
-
UNDERTOW-2597 MultiPartParserDefinition must check for entity size larger than zero
-
- Closed
-
- is incorporated by
-
WFCORE-7381 [CVE-2024-4109, CVE-2025-9784] Upgrade Undertow to 2.3.20.Final
-
- Resolved
-