Bug 2408784 (CVE-2025-12543)

Summary: CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abrianik, aschwart, asoldano, bbaranow, bmaxwell, boliveir, brian.stansberry, darran.lofthouse, dhanak, dosoudil, drosa, fjuma, fmariani, ggrzybek, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jrokos, kverlaen, mnovotny, mosmerov, mposolda, msvehla, nwallace, parichar, pberan, pdelbell, pesilva, pjindal, pmackay, rmartinc, rstancel, rstepani, sausingh, security-response-team, smaestri, ssilvert, sthorger, tasato, tcunning, tom.jenkinson, vmuzikar, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2427892, 2427893, 2427894, 2427895    
Bug Blocks:    
Deadline: 2026-01-09   

Description OSIDB Bzimport 2025-10-31 06:53:28 UTC 
An Improper Input Validation vulnerability exists in the Undertow HTTP server (io.undertow:undertow-core) where the implementation does not return a 400 Bad Request response when receiving requests with invalid or malformed Host headers. The flaw can be exploited by remote attackers via specially crafted HTTP requests. Depending on the deployment, the issue enables web cache poisoning, session hijacking, or server-side request forgery (SSRF). Attackers may inject malicious responses into caches, steal authentication tokens, or redirect users to malicious endpoints. Successful exploitation can result in complete account takeover, widespread credential theft, or unauthorized access to internal network resources, thereby compromising confidentiality and integrity of user data.
Comment 1 errata-xmlrpc 2026-01-08 16:53:55 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1

Via RHSA-2026:0386 https://access.redhat.com/errata/RHSA-2026:0386
Comment 2 errata-xmlrpc 2026-01-08 16:54:52 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

Via RHSA-2026:0383 https://access.redhat.com/errata/RHSA-2026:0383
Comment 3 errata-xmlrpc 2026-01-08 16:55:15 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

Via RHSA-2026:0384 https://access.redhat.com/errata/RHSA-2026:0384