CVE-2026-101021
Received Received - Intake

Multipart Boundary Processing Flaw in Apache Tomcat

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: ICS-CERT

Description
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-101021
EUVD
EUVD-2026-102893

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
J4Care dcm4chee-arc-light 5.35.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101021 is a flaw in the MultipartInputStream component where inefficient boundary matching and unnecessary buffer copying occur. Crafted multipart input can trigger excessive boundary comparisons and repeated copying, potentially causing a denial-of-service condition.

Detection Guidance

Detecting this vulnerability may require monitoring for unusual network traffic patterns or resource exhaustion. Check for excessive CPU usage or memory consumption during multipart form data processing. Inspect logs for repeated boundary comparison errors or buffer overflow warnings in applications using MultipartInputStream.

Impact Analysis

This vulnerability may lead to system slowdowns or crashes due to excessive resource consumption from repeated boundary checks and buffer operations. It could disrupt services relying on multipart input processing.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It primarily causes denial-of-service conditions through inefficient processing, which may indirectly impact availability of systems handling sensitive data. No specific compliance violations are mentioned in the provided context.

Mitigation Strategies

Upgrade to J4Care release 5.35.2 or later to address the inefficient boundary matching and buffer copying issues in MultipartInputStream.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart