FKIE_CVE-2025-12543

Vulnerability from fkie_nvd - Published: 2026-01-07 17:15 - Updated: 2026-03-18 16:16
Severity ?
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Summary
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
References
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:0383Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:0384Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:0386Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:3889Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:3890Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:3891Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:3892Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:4915
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:4916
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:4917
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:4924
secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2025-12543Vendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2408784Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
redhat build_of_apache_camel *
redhat data_grid 8.0
redhat fuse 7.0.0
redhat jboss_enterprise_application_platform *
redhat jboss_enterprise_application_platform *
redhat jboss_enterprise_application_platform -
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_enterprise_application_platform_expansion_pack -
redhat process_automation 7.0
redhat single_sign-on 7.0
redhat undertow *
redhat undertow *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:build_of_apache_camel:*:*:*:*:*:spring_boot:*:*",
              "matchCriteriaId": "07091FB7-A140-4D8E-BDB8-1EC9CF463F53",
              "versionEndExcluding": "4.14.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7095200A-4DAC-4433-99E8-86CA88E1E4D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAD91726-93D9-4230-BF69-6A79B58E09E0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D2DF1E8-9000-4FB5-9EA8-138D8FB3E2CA",
              "versionEndExcluding": "8.0.12",
              "versionStartIncluding": "8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "47585EEB-2EB2-42D6-B06E-290BCE788A9F",
              "versionEndExcluding": "8.1.3",
              "versionStartIncluding": "8.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*",
              "matchCriteriaId": "B8423D7F-3A8F-4AD8-BF51-245C9D8DD816",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "72A54BDA-311C-413B-8E4D-388AD65A170A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A24CBFB-4900-47A5-88D2-A44C929603DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "20A6B40D-F991-4712-8E30-5FE008505CB7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD2DF681-F91C-41CD-8031-1A0ABC2EF051",
              "versionEndExcluding": "2.2.39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F2313BE-DB2E-4F91-9F8D-6428B276037A",
              "versionEndExcluding": "2.3.21",
              "versionStartIncluding": "2.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una vulnerabilidad en el n\u00facleo del servidor HTTP Undertow, que se utiliza en WildFly, JBoss EAP y otras aplicaciones Java. La biblioteca Undertow no valida correctamente el encabezado Host en las solicitudes HTTP entrantes. Como resultado, las solicitudes que contienen encabezados Host malformados o maliciosos se procesan sin ser rechazadas, lo que permite a los atacantes envenenar cach\u00e9s, realizar escaneos de red internos o secuestrar sesiones de usuario."
    }
  ],
  "id": "CVE-2025-12543",
  "lastModified": "2026-03-18T16:16:22.420",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-01-07T17:15:55.093",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2026:0383"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2026:0384"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2026:0386"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2026:3889"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2026:3890"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2026:3891"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2026:3892"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:4915"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:4916"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:4917"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:4924"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/CVE-2025-12543"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408784"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.