CVE-2025-12543

Published Jan 7, 2026

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-12543 describes a flaw within the Undertow HTTP server core, a component utilized in various Java applications including WildFly and JBoss EAP. The vulnerability stems from the Undertow library's failure to adequately validate the `Host` header in incoming HTTP requests. This improper input validation (CWE-20) allows the server to process requests containing malformed or malicious `Host` headers without rejection. The acceptance of these manipulated `Host` headers can enable attackers to exploit the system in several ways. Potential impacts include cache poisoning, which can lead to persistent malicious entries in caches, the ability to perform internal network scans, and the hijacking of user sessions. This issue arises because downstream application logic, frameworks, or proxies may trust the unvalidated `Host` header for security-relevant decisions.

Description: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
Source: secalert@redhat.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.6
Impact score: 6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Severity: CRITICAL

Weaknesses

secalert@redhat.com: CWE-20

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 7

References