CVE-2025-12543: Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-07 · updated 2026-10-14
Weakness: CWE-20

Description

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Affected products

RedHat Build Of Apache Camel: before 4.14.4 — fixed in 4.14.4
RedHat Data Grid: 8.0
Red Hat Fuse: 7.0.0
Red Hat JBoss EAP: from 8.0 before 8.0.12; from 8.1.0 before 8.1.3; 7.0.0 — fixed in 8.0.12, 8.1.3
RedHat Jboss Enterprise Application Platform Expansion Pack: all versions
RedHat Process Automation: 7.0
Red Hat Single Sign-On: 7.0
Red Hat undertow: before 2.2.39; from 2.3.0 before 2.3.21 — fixed in 2.2.39, 2.3.21

How to fix

Upgrade to a fixed version: RedHat Build Of Apache Camel 4.14.4; Red Hat JBoss EAP 8.0.12, 8.1.3; Red Hat undertow 2.2.39, 2.3.21. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-12543 or the next vulnerability affects your stack