CVE-2025-12543
published 2026-01-07CVE-2025-12543: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly…
PriorityP353critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
1.18%
64.0th percentile
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | undertow | — | — |
| redhat | build_of_apache_camel | < 4.14.4 | 4.14.4 |
| redhat | data_grid | — | — |
| redhat | fuse | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | jboss_enterprise_application_platform | >= 8.0 < 8.0.12 | 8.0.12 |
| redhat | jboss_enterprise_application_platform | >= 8.1.0 < 8.1.3 | 8.1.3 |
| redhat | process_automation | — | — |
| redhat | single_sign-on | — | — |
| redhat | undertow | < 2.2.39 | 2.2.39 |
| redhat | undertow | >= 2.3.0 < 2.3.21 | 2.3.21 |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
osv9.6CRITICAL
vendor_debian9.6CRITICAL
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Undertow vulnerability
vendor_ubuntu·2026-04-02
CVE-2025-12543 Undertow vulnerability
Title: Undertow vulnerability
Summary: Undertow would allow unintended access to user sessions over the network.
It was discovered that Undertow incorrectly validated the Host header in
incoming HTTP requests. A remote attacker could possibly use this issue
to gain unintended access to user sessions.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
vendor_redhat·2026-01-08·CVSS 9.6
CVE-2025-12543 [CRITICAL] CWE-20 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host header
Debian
CVE-2025-12543: undertow - A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBo...
vendor_debian·2025·CVSS 9.6
CVE-2025-12543 [CRITICAL] CVE-2025-12543: undertow - A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBo...
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
Scope: local
forky: open
sid: open
GHSA
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
ghsa·2026-01-07
CVE-2025-12543 [CRITICAL] CWE-20 Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
OSV
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
osv·2026-01-07
CVE-2025-12543 [CRITICAL] Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
OSV
CVE-2025-12543: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications
osv·2026-01-07·CVSS 9.6
CVE-2025-12543 [CRITICAL] CVE-2025-12543: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-12543 resteasy: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF [fedora-42]
bugzilla·2026-01-08·CVSS 9.6
CVE-2025-12543 [CRITICAL] CVE-2025-12543 resteasy: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF [fedora-42]
CVE-2025-12543 resteasy: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42
Bugzilla
CVE-2025-12543 moditect: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF [fedora-42]
bugzilla·2026-01-08·CVSS 9.6
CVE-2025-12543 [CRITICAL] CVE-2025-12543 moditect: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF [fedora-42]
CVE-2025-12543 moditect: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42
Bugzilla
CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
bugzilla·2025-10-31·CVSS 9.6
CVE-2025-12543 [CRITICAL] CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
An Improper Input Validation vulnerability exists in the Undertow HTTP server (io.undertow:undertow-core) where the implementation does not return a 400 Bad Request response when receiving requests with invalid or malformed Host headers. The flaw can be exploited by remote attackers via specially crafted HTTP requests. Depending on the deployment, the issue enables web cache poisoning, session hijacking, or server-side request forgery (SSRF). Attackers may inject malicious responses into caches, steal authentication tokens, or redirect users to malicious endpoints. Successful exploitation can result in complete account takeover, widespread credential thef
Qualys
Oracle Critical Patch Update, April 2026 Security Update Review
blogs_qualys·2026-04-22
CVE-2025-6965 Oracle Critical Patch Update, April 2026 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 481 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 139, constituting about 28% of the total patches released. Oracle Financial Services Applications and Oracle Fusion Middleware followed, with 75 and 59 security patches.
376 of the 481 security patches provided by the April Critical Patch Update (about 78%)
Wiz
CVE-2025-12543 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.6
CVE-2025-12543 [CRITICAL] CVE-2025-12543 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-12543 :
Java vulnerability analysis and mitigation
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
Source : NVD
## 9.6
Score
Published January 7, 2026
Severity CRITICAL
CNA Score 9.6
Affected Technologies
Java
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 14.7
Exploitation Probability (EPSS) N/A
Affected packages a
https://access.redhat.com/errata/RHSA-2026:0383https://access.redhat.com/errata/RHSA-2026:0384https://access.redhat.com/errata/RHSA-2026:0386https://access.redhat.com/errata/RHSA-2026:33371https://access.redhat.com/errata/RHSA-2026:33372https://access.redhat.com/errata/RHSA-2026:3889https://access.redhat.com/errata/RHSA-2026:3890https://access.redhat.com/errata/RHSA-2026:3891https://access.redhat.com/errata/RHSA-2026:3892https://access.redhat.com/errata/RHSA-2026:4915https://access.redhat.com/errata/RHSA-2026:4916https://access.redhat.com/errata/RHSA-2026:4917https://access.redhat.com/errata/RHSA-2026:4924https://access.redhat.com/security/cve/CVE-2025-12543https://bugzilla.redhat.com/show_bug.cgi?id=2408784https://access.redhat.com/errata/RHSA-2026:0383https://access.redhat.com/errata/RHSA-2026:0384https://access.redhat.com/errata/RHSA-2026:0386https://access.redhat.com/errata/RHSA-2026:33371https://access.redhat.com/errata/RHSA-2026:33372https://access.redhat.com/errata/RHSA-2026:3889https://access.redhat.com/errata/RHSA-2026:3890https://access.redhat.com/errata/RHSA-2026:3891https://access.redhat.com/errata/RHSA-2026:3892https://access.redhat.com/errata/RHSA-2026:4915https://access.redhat.com/errata/RHSA-2026:4916https://access.redhat.com/errata/RHSA-2026:4917https://access.redhat.com/errata/RHSA-2026:4924https://access.redhat.com/security/cve/CVE-2025-12543https://bugzilla.redhat.com/show_bug.cgi?id=2408784https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-12543.json
2026-01-07
Published