erroneo.us
Search all guides⌘K

Security Digest · Vulnerability record

CVE-2025-12543: Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.

CVSS 9.6 Critical EPSS 1.3% · p71

Updated By erroneo.us Security Desk29 references Seen in the digest for Jan 7, 2026

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

  • Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
  • EPSS 1.3%, percentile 71: FIRST’s model estimates a 1.3% chance of exploitation activity in the next 30 days, higher than 71% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
  • Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
  • Only applies if your dependency tree includes io.undertow:undertow-core (Maven) = 2.4.0.Alpha1, no fixed version listed; io.undertow:undertow-core (Maven) >= 2.3.0.Alpha1, < 2.3.21.Final, fixed in 2.3.21.Final; io.undertow:undertow-core (Maven) < 2.2.39.Final, fixed in 2.2.39.Final. Check your lockfile, including transitive dependencies.

What it is

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

From the GitHub advisory

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Weakness type: CWE-20.

Product: io.undertow:undertow-core (Maven) · Assigned by: redhat · Published: 2026-01-07

Affected and fixed versions

EcosystemPackageVulnerableFirst fixed
Mavenio.undertow:undertow-core= 2.4.0.Alpha1none listed
Mavenio.undertow:undertow-core>= 2.3.0.Alpha1, < 2.3.21.Final2.3.21.Final
Mavenio.undertow:undertow-core< 2.2.39.Final2.2.39.Final
VendorProductAffected versions (per CVE record)
Red HatRed Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 7.4.24see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9see vendor advisory

Severity scores

Scored byCVSSScoreVector
redhat3.19.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
redhat-SADP3.19.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
GitHub3.19.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
  • Attack vector: network (remotely reachable)
  • Attack complexity: low
  • Privileges required: none (no login)
  • User interaction: required (a user must click/open something)
  • Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

  • CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
  • CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
  • FIRST EPSS (model of 2026-10-21): 1.33% probability of exploitation activity in the next 30 days; percentile 71.

Timeline

  • — CVE record published by redhat
  • — GitHub-reviewed advisory GHSA-j382-5jj3-vw4j published (critical)
  • — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

  1. RHSA-2026:0383 access.redhat.com
  2. RHSA-2026:0384 access.redhat.com
  3. RHSA-2026:0386 access.redhat.com
  4. RHSA-2026:33371 access.redhat.com
  5. RHSA-2026:33372 access.redhat.com
  6. RHSA-2026:3889 access.redhat.com
  7. RHSA-2026:3890 access.redhat.com
  8. RHSA-2026:3891 access.redhat.com
  9. RHSA-2026:3892 access.redhat.com
  10. RHSA-2026:4915 access.redhat.com
  11. RHSA-2026:4916 access.redhat.com
  12. RHSA-2026:4917 access.redhat.com
  13. RHSA-2026:4924 access.redhat.com
  14. RHSA-2026:76128 access.redhat.com
  15. RHSA-2026:76129 access.redhat.com
  16. RHSA-2026:76130 access.redhat.com
  17. RHSA-2026:76132 access.redhat.com
  18. RHSA-2026:76134 access.redhat.com

Vulnerability records

  1. GitHub Advisory GHSA-j382-5jj3-vw4j github.com
  2. CVE.org record CVE-2025-12543 cve.org
  3. NVD entry CVE-2025-12543 nvd.nist.gov

Other references from the CVE record and advisory

  1. access.redhat.com access.redhat.com
  2. RHBZ#2408784 bugzilla.redhat.com
  3. security.access.redhat.com security.access.redhat.com
  4. github.com github.com
  5. github.com github.com
  6. github.com github.com
  7. github.com github.com
  8. issues.redhat.com issues.redhat.com

Critical Maven advisories · Today’s Security Digest