An Improper Input Validation vulnerability exists in the Undertow HTTP server (io.undertow:undertow-core) where the implementation does not return a 400 Bad Request response when receiving requests with invalid or malformed Host headers. The flaw can be exploited by remote attackers via specially crafted HTTP requests. Depending on the deployment, the issue enables web cache poisoning, session hijacking, or server-side request forgery (SSRF). Attackers may inject malicious responses into caches, steal authentication tokens, or redirect users to malicious endpoints. Successful exploitation can result in complete account takeover, widespread credential theft, or unauthorized access to internal network resources, thereby compromising confidentiality and integrity of user data.