CVE-2025-12543
The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
- CVSS 3.1
- 9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS
- 1.35% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- redhat/build of apache camel · redhat/data grid · redhat/fuse · redhat/jboss enterprise application platform · redhat/jboss enterprise application platform expansion pack · redhat/process automation · redhat/single sign-on · redhat/undertow
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2026:0383Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0384Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0386Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:33371
- https://access.redhat.com/errata/RHSA-2026:33372
- https://access.redhat.com/errata/RHSA-2026:3889Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3890Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3891Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3892Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:4915
- https://access.redhat.com/errata/RHSA-2026:4916
- https://access.redhat.com/errata/RHSA-2026:4917
- https://access.redhat.com/errata/RHSA-2026:4924
- https://access.redhat.com/security/cve/CVE-2025-12543Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2408784Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0383Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0384Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0386Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:33371
- https://access.redhat.com/errata/RHSA-2026:33372
- https://access.redhat.com/errata/RHSA-2026:3889Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3890Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3891Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3892Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:4915
- https://access.redhat.com/errata/RHSA-2026:4916
- https://access.redhat.com/errata/RHSA-2026:4917
- https://access.redhat.com/errata/RHSA-2026:4924
- https://access.redhat.com/security/cve/CVE-2025-12543Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2408784Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.