CVE-2025-12543: Red Hat Undertow improper Host header validation

CVE-2025-12543 · Severity: critical · CVSS 9.6 · Published 2026-01-07

Undertow is a high-performance web server component used in major Java applications like WildFly and JBoss EAP. A security flaw has been identified where the server fails to properly check the 'Host' header in web requests. This could allow an attacker to trick the system into misrouting traffic, poisoning web caches, or gaining unauthorized access to internal network resources and user sessions.

Technologies: io.undertow:undertow-core (Maven), Red Hat WildFly. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2025-12543 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-12543 being exploited in the wild.
How severe is CVE-2025-12543?
Critical severity, with a CVSS score of 9.6, published 7 January 2026.
Which products and versions are affected?
io.undertow:undertow-core (Maven) ECOSYSTEM:introduced=2.3.0.Alpha1,fixed=2.3.21.Final; Red Hat Apache Camel for Spring Boot 4.14.x.
Is there a fix for CVE-2025-12543?
Yes. io.undertow:undertow-core (Maven): upgrade to 2.3.21.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-12543 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-12543?
Check whether you run io.undertow:undertow-core (Maven), Red Hat Apache Camel for Spring Boot or Red Hat WildFly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.undertow:undertow-core (Maven): upgrade to 2.3.21.Final or later
    # set io.undertow:undertow-core to 2.3.21.Final in your pom.xml or build.gradle

Technical details

A flaw was found in the Undertow HTTP server core's input validation logic. The library fails to properly validate or reject malformed Host headers in incoming HTTP requests. An unauthenticated remote attacker can exploit this by sending specially crafted headers, which the server processes without rejection. This vulnerability can be leveraged to perform HTTP Cache Poisoning, Server-Side Request Forgery (SSRF) via internal network scans, or session hijacking. Red Hat has released updates for affected products, including JBoss EAP 8.1.3, which upgrades Undertow to version 2.3.20.SP4-redhat-00001 to resolve the issue.

Affected products

  • Red Hat Undertow versions prior to 2.3.20.SP4-redhat-00001
  • Red Hat JBoss Enterprise Application Platform (EAP) 8.1.x, 7.4.x
  • Red Hat WildFly
  • Red Hat Apache Camel for Spring Boot 4.14.x

Identifiers

  • CVE-2025-12543
  • GHSA-j382-5jj3-vw4j

Timeline

  • 2025-01-07: disclosed: CVE published
  • 2026-01-08: patched: Red Hat released security advisories (RHSA-2026:0383, RHSA-2026:0384)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.