A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP r…
Critical CVSS 9.6
Summary
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://access.redhat.com/errata/RHSA-2026:0383 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0384 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0386 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:33371
- https://access.redhat.com/errata/RHSA-2026:33372
- https://access.redhat.com/errata/RHSA-2026:3889 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3890 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3891 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3892 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:4915
- https://access.redhat.com/errata/RHSA-2026:4916
- https://access.redhat.com/errata/RHSA-2026:4917
- https://access.redhat.com/errata/RHSA-2026:4924
- https://access.redhat.com/security/cve/CVE-2025-12543 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2408784 Issue Tracking
- https://access.redhat.com/errata/RHSA-2026:0383 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0384 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:0386 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:33371
- https://access.redhat.com/errata/RHSA-2026:33372
- https://access.redhat.com/errata/RHSA-2026:3889 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3890 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3891 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3892 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:4915
- https://access.redhat.com/errata/RHSA-2026:4916
- https://access.redhat.com/errata/RHSA-2026:4917
- https://access.redhat.com/errata/RHSA-2026:4924
- https://access.redhat.com/security/cve/CVE-2025-12543 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2408784 Issue Tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-12543.json
Timeline
- nvd_ingest NVD