Vulnerability Description
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Build Of Apache Camel | < 4.14.4 |
| Redhat | Data Grid | 8.0 |
| Redhat | Fuse | 7.0.0 |
| Redhat | Jboss Enterprise Application Platform | >= 8.0, < 8.0.12 |
| Redhat | Jboss Enterprise Application Platform Expansion Pack | - |
| Redhat | Process Automation | 7.0 |
| Redhat | Single Sign-On | 7.0 |
| Redhat | Undertow | < 2.2.39 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:0383Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0384Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0386Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3889Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3890Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3891Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3892Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:4915
- https://access.redhat.com/errata/RHSA-2026:4916
- https://access.redhat.com/errata/RHSA-2026:4917
- https://access.redhat.com/errata/RHSA-2026:4924
- https://access.redhat.com/security/cve/CVE-2025-12543Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2408784Issue TrackingVendor Advisory
FAQ
What is CVE-2025-12543?
CVE-2025-12543 is a vulnerability with a CVSS score of 9.6 (CRITICAL). A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP re...
How severe is CVE-2025-12543?
CVE-2025-12543 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-12543?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Build Of Apache Camel, Redhat Data Grid, Redhat Fuse, Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack.