Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-12543

Good to know:

icon
icon

Date: January 7, 2026

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Severity Score

Related Resources (11)

https://nvd.nist.gov/vuln/detail/CVE-2025-12543
https://github.com/undertow-io/undertow/pull/1857
https://access.redhat.com/security/cve/CVE-2025-12543
https://bugzilla.redhat.com/show_bug.cgi?id=2408784
https://github.com/undertow-io/undertow
https://github.com/undertow-io/undertow/pull/1860
https://access.redhat.com/errata/RHSA-2026:0386
https://access.redhat.com/errata/RHSA-2026:0383
https://access.redhat.com/errata/RHSA-2026:0384
https://github.com/undertow-io/undertow/releases/tag/2.3.21.Final
https://www.mend.io/vulnerability-database/CVE-2025-12543

Severity Score

Weakness Type (CWE)

Improper Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version io.undertow:undertow-core:2.3.21.Final;io.undertow:undertow-core:2.2.39.Final

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): LOW

Do you need more information?

Contact Us