Vulnerability · Published Jan 7, 2026 · Assigned by redhat

CVE-2025-12543Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Critical 9.6

In plain English

A critical-severity improper input validation in Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)1.3%top 28.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	undertow	no fix listed	DEBIAN-CVE-2025-12543
Maven	io.undertow:undertow-core	2.3.21.Final	GHSA-j382-5jj3-vw4j
Maven	io.undertow:undertow-core	2.2.39.Final	GHSA-j382-5jj3-vw4j
Maven	io.undertow:undertow-core	no fix listed	GHSA-j382-5jj3-vw4j
Ubuntu:25.10	undertow	no fix listed	UBUNTU-CVE-2025-12543
Ubuntu:26.04:LTS	undertow	2.3.20-1ubuntu1	UBUNTU-CVE-2025-12543
Ubuntu:26.10	undertow	2.3.20-1ubuntu1	UBUNTU-CVE-2025-12543

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4.24	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1.3	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	see references

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

References

RHSA-2026:0383 vendor-advisory, x_refsource_REDHAT
RHSA-2026:0384 vendor-advisory, x_refsource_REDHAT
RHSA-2026:0386 vendor-advisory, x_refsource_REDHAT
RHSA-2026:33371 vendor-advisory, x_refsource_REDHAT
RHSA-2026:33372 vendor-advisory, x_refsource_REDHAT
RHSA-2026:3889 vendor-advisory, x_refsource_REDHAT
RHSA-2026:3890 vendor-advisory, x_refsource_REDHAT
RHSA-2026:3891 vendor-advisory, x_refsource_REDHAT
RHSA-2026:3892 vendor-advisory, x_refsource_REDHAT
RHSA-2026:4915 vendor-advisory, x_refsource_REDHAT
RHSA-2026:4916 vendor-advisory, x_refsource_REDHAT
RHSA-2026:4917 vendor-advisory, x_refsource_REDHAT
RHSA-2026:4924 vendor-advisory, x_refsource_REDHAT
RHSA-2026:76128 vendor-advisory, x_refsource_REDHAT
RHSA-2026:76129 vendor-advisory, x_refsource_REDHAT
RHSA-2026:76130 vendor-advisory, x_refsource_REDHAT
RHSA-2026:76132 vendor-advisory, x_refsource_REDHAT
RHSA-2026:76134 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-12543 vdb-entry, x_refsource_REDHAT
RHBZ#2408784 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-12543.json x_sadp-csaf-vex