CVE-2025-12543

critical · 9.6

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

9.6

CVSS

1.4%

EPSS (exploit prob.)

70th

EPSS percentile

2026-01-07

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
redhat	build_of_apache_camel	< 4.14.4
redhat	data_grid	8.0
redhat	fuse	7.0.0
redhat	jboss_enterprise_application_platform	>= 8.0, < 8.0.12
redhat	jboss_enterprise_application_platform	>= 8.1.0, < 8.1.3
redhat	jboss_enterprise_application_platform	all versions
redhat	jboss_enterprise_application_platform	7.0.0
redhat	jboss_enterprise_application_platform_expansion_pack	all versions
redhat	process_automation	7.0
redhat	single_sign-on	7.0
redhat	undertow	< 2.2.39
redhat	undertow	>= 2.3.0, < 2.3.21

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-12543