--- id: CVE-2025-12543 title: >- A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications summary: >- A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containi… severity: critical cvss: 9.6 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L' cwe: - CWE-20 vendor: redhat product: build_of_apache_camel affected: - build_of_apache_camel < 4.14.4 - data_grid = 8.0 - fuse = 7.0.0 - 'jboss_enterprise_application_platform >= 8.0, < 8.0.12' - 'jboss_enterprise_application_platform >= 8.1.0, < 8.1.3' - jboss_enterprise_application_platform - jboss_enterprise_application_platform = 7.0.0 - jboss_enterprise_application_platform_expansion_pack - process_automation = 7.0 - single_sign-on = 7.0 - undertow < 2.2.39 - 'undertow >= 2.3.0, < 2.3.21' patched: - build_of_apache_camel 4.14.4 - jboss_enterprise_application_platform 8.1.3 - undertow 2.3.21 published: '2026-01-07' updated: '2026-10-14' sourceUpdated: '2026-10-14T17:17:40.837' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-12543' references: - url: 'https://access.redhat.com/errata/RHSA-2026:0383' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0384' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0386' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:33371' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:33372' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:3889' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:3890' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:3891' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:3892' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4915' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4916' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4917' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4924' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76128' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76129' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76130' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76132' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76134' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2025-12543' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2408784' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0383' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:0384' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:0386' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33371' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33372' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3889' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3890' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3891' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3892' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4915' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4916' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4917' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4924' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2025-12543' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2408784' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-12543.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2025-12543' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-12543' tags: - nvd - exploit-available - cve.org - csaf - vex - red-hat epss: 0.01333 epssPercentile: 0.70964 exploits: github: 1 githubRepos: - 'https://github.com/kavin71725/CVE-2025-12543-Fix-for-Wildfly' checkedAt: '2026-10-27T16:50:31.196Z' exploitAvailable: true ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-01-07T00:00:00+00:00' ingestedAt: '2026-06-29T13:24:34.624Z' --- ## Overview A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions. ## Affected - `build_of_apache_camel < 4.14.4` - `data_grid = 8.0` - `fuse = 7.0.0` - `jboss_enterprise_application_platform >= 8.0, < 8.0.12` - `jboss_enterprise_application_platform >= 8.1.0, < 8.1.3` - `jboss_enterprise_application_platform` - `jboss_enterprise_application_platform = 7.0.0` - `jboss_enterprise_application_platform_expansion_pack` - `process_automation = 7.0` - `single_sign-on = 7.0` - `undertow < 2.2.39` - `undertow >= 2.3.0, < 2.3.21` ## Remediation Upgrade past the affected range: - `build_of_apache_camel 4.14.4` - `jboss_enterprise_application_platform 8.1.3` - `undertow 2.3.21` ## Vendor advisories - **RHSA-2026:33372** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33372) - **RHSA-2026:33371** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33371) - **RHSA-2026:4915** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4915) - **RHSA-2026:4916** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 8 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4916) - **RHSA-2026:3889** · Red Hat · fixed in: Red Hat JBoss EAP 8.0 for RHEL 8 · released 2026-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:3889) - **RHSA-2026:0383** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 8 · released 2026-01-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:0383) - **RHSA-2026:76134** · Red Hat · fixed in: Middleware Containers for OpenShift · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76134) - **RHSA-2026:4917** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4917) - **RHSA-2026:3891** · Red Hat · fixed in: Red Hat JBoss EAP 8.0 for RHEL 9 · released 2026-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:3891) - **RHSA-2026:0384** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 9 · released 2026-01-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:0384) - **RHSA-2026:4924** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.4.24 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4924) - **Red Hat VEX** · Important · affected: Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Process Automation 7 · no fix planned: Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Process Automation 7, Red Hat JBoss Enterprise Application Platform 7, … · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-12543.json)