CVE-2025-12543 is a critical (9.6) flaw in the Undertow HTTP server, which does not reject malformed Host headers. It can enable cache poisoning, internal network scans and session hijack. Red Hat shipped errata for JBoss EAP and other products, so apply the one that matches your product and version.
What's affected
The record lists Red Hat products that include Undertow: JBoss Enterprise Application Platform and its expansion pack, Fuse, Data Grid, Process Automation, Single Sign-On, Build of Apache Camel and Undertow itself.
I read errata RHSA-2026:0383, rated Important, issued 8 January 2026. It updates JBoss EAP 8.1.3 for RHEL 8 and ships undertow 2.3.20-2.SP4_redhat_00001.1.el8eap. Other products and versions have their own errata. The record also links RHSA-2026:0384, 0386, 33371, 33372 and 3889, which I did not read, so match the right errata to your product.
The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C, with high confidentiality and integrity impact. The advisory title reads: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF.
How to check if you're exposed
Find out which Undertow you run.
rpm -qa | grep -i undertow
find / -name "undertow-core*.jar" 2>/dev/null
For Maven or Gradle applications that bundle Undertow, list the dependency tree.
mvn dependency:tree | grep undertow
./gradlew dependencies | grep undertow
Compare what you find with the fixed package named in the Red Hat errata for your product. Upstream WildFly and community builds are not covered by the Red Hat errata, so check the upstream project for their fix. You can also paste a manifest into the free scan at gold.safeguard.sh/scan.
What to do now
- Inventory every JBoss EAP, WildFly and application that bundles undertow-core.
- Open the Red Hat CVE page and pick the errata for your product and version.
- Back up the installation and apply earlier relevant errata first, as the advisory asks.
- Restart services, then confirm the new Undertow version with the commands above.
- Make sure any reverse proxy or load balancer in front validates the Host header and only forwards expected host names.
Why it matters
The weakness is CWE-20, improper input validation. The server accepts a Host header that does not follow the rules for a host name and processes the request anyway. Applications and caches downstream often trust that header to build links, pick a tenant or decide where to send a redirect.
When the Host value is attacker influenced, a cache can store a poisoned page, password reset links can point to the wrong site, and the server may be coaxed into requests to internal addresses. Strict validation at the edge, with an allowlist of host names, limits the damage even in applications that trust the header.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which products are covered?
The record lists several Red Hat products that include Undertow. Each has its own errata, so match yours.
What can a bad Host header do?
The record names cache poisoning, internal network scans and session hijack.
Sources
Last reviewed: 19 October 2026.
