CVE-2025-12543

EUVD-2026-1207
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.6 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 65.81%
Affected Products (NVD)
VendorProductVersion
redhatbuild_of_apache_camel
𝑥
< 4.14.4
redhatdata_grid
8.0
redhatfuse
7.0.0
redhatjboss_enterprise_application_platform
8.0 ≤
𝑥
< 8.0.12
redhatjboss_enterprise_application_platform
8.1.0 ≤
𝑥
< 8.1.3
redhatjboss_enterprise_application_platform
-
redhatjboss_enterprise_application_platform
7.0.0
redhatjboss_enterprise_application_platform_expansion_pack
-
redhatprocess_automation
7.0
redhatsingle_sign-on
7.0
redhatundertow
𝑥
< 2.2.39
redhatundertow
2.3.0 ≤
𝑥
< 2.3.21
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
0:1.4.18-21.SP19_redhat_00001.1.ep7.el7 ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
0:2.0.41-8.SP9_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4.24
2.2.39.Final-redhat-00001 ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.2.39-1.Final_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:7.4.24-4.GA_redhat_00002.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.2.39-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:7.4.24-4.GA_redhat_00002.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.2.39-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:7.4.24-4.GA_redhat_00002.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
0:1.83.0-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
0:33.0.0-2.jre_redhat_00003.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
0:4.0.6-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
0:1.0.0-3.redhat_00009.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
0:2.0.2-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
0:2.3.23-1.SP3_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
0:1.83.0-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
0:33.0.0-2.jre_redhat_00003.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
0:4.0.6-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
0:1.0.0-3.redhat_00009.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
0:2.0.2-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
0:2.3.23-1.SP3_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:4.0.10-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:1.82.0-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:801.3.0-1.GA_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:1.0.1-3.redhat_00003.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:6.6.36-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:4.0.2-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.5.0-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.3.20-2.SP4_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:8.1.3-4.GA_redhat_00006.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:5.0.12-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.6.6-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:8.1.1-4.GA_redhat_00007.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:4.0.10-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:1.82.0-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:801.3.0-1.GA_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:1.0.1-3.redhat_00003.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:6.6.36-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:4.0.2-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.5.0-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.3.20-2.SP4_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:8.1.3-4.GA_redhat_00006.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:5.0.12-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.6.6-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:8.1.1-4.GA_redhat_00007.1.el9eap ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
undertow
forky
vulnerable
sid
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
undertow
bionic
Fixed 1.4.23-3ubuntu0.1~esm1
released
focal
Fixed 2.0.29-1ubuntu0.1~esm1
released
jammy
Fixed 2.2.16-1ubuntu0.1~esm1
released
noble
Fixed 2.3.8-2ubuntu0.1~esm1
released
plucky
ignored
questing
ignored
resolute
Fixed 2.3.20-1ubuntu1
released
xenial
Fixed 1.3.16-1ubuntu0.1~esm1
released
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:0383
https://access.redhat.com/errata/RHSA-2026:0384
https://access.redhat.com/errata/RHSA-2026:0386
https://access.redhat.com/errata/RHSA-2026:33371
https://access.redhat.com/errata/RHSA-2026:33372
https://access.redhat.com/errata/RHSA-2026:3889
https://access.redhat.com/errata/RHSA-2026:3890
https://access.redhat.com/errata/RHSA-2026:3891
https://access.redhat.com/errata/RHSA-2026:3892
https://access.redhat.com/errata/RHSA-2026:4915
https://access.redhat.com/errata/RHSA-2026:4916
https://access.redhat.com/errata/RHSA-2026:4917
https://access.redhat.com/errata/RHSA-2026:4924
https://access.redhat.com/security/cve/CVE-2025-12543
https://bugzilla.redhat.com/show_bug.cgi?id=2408784
https://access.redhat.com/errata/RHSA-2026:0383
https://access.redhat.com/errata/RHSA-2026:0384
https://access.redhat.com/errata/RHSA-2026:0386
https://access.redhat.com/errata/RHSA-2026:33371
https://access.redhat.com/errata/RHSA-2026:33372
https://access.redhat.com/errata/RHSA-2026:3889
https://access.redhat.com/errata/RHSA-2026:3890
https://access.redhat.com/errata/RHSA-2026:3891
https://access.redhat.com/errata/RHSA-2026:3892
https://access.redhat.com/errata/RHSA-2026:4915
https://access.redhat.com/errata/RHSA-2026:4916
https://access.redhat.com/errata/RHSA-2026:4917
https://access.redhat.com/errata/RHSA-2026:4924
https://access.redhat.com/security/cve/CVE-2025-12543
https://bugzilla.redhat.com/show_bug.cgi?id=2408784
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-12543.json