CVE-2025-12543 Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
Attackers can exploit improper Host header validation in Undertow to perform SSRF, cache poisoning, or session hijacking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-12543?
CVE-2025-12543 is a critical server-side request forgery vulnerability in Redhat Jboss Enterprise Application Platform, published on 7 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
Weakness: CWE-20
Which versions are affected by CVE-2025-12543?
6 open source packages ship an affected version, including io.undertow:undertow-core. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
io.undertow:undertow-core Maven | All versions | None |
io.undertow:undertow-core Maven | All versions | None |
io.undertow:undertow-core Maven | All versions | 2.2.39.Final |
io.undertow:undertow-core Maven | All versions | 2.2.39.Final |
io.undertow:undertow-core Maven | From 2.3.0.Alpha1 | 2.3.21.Final |
io.undertow:undertow-core Maven | From 2.3.0.Alpha1 | 2.3.21.Final |
Products include Redhat Build of Apache Camel, Redhat Data Grid, Redhat Fuse, Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack, Redhat Process Automation and 2 more.
How do I fix CVE-2025-12543?
Upgrade io.undertow:undertow-core to a fixed version for your release line: 2.2.39.Final or 2.3.21.Final.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-12543 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12543 exists.
Sources
Also known as CLSA-2026-1770682162, DEBIAN-CVE-2025-12543, GHSA-j382-5jj3-vw4j, UBUNTU-CVE-2025-12543, USN-8144-1.