ZeroDay Findings
Sign inSign up

Findings

CVE-2025-12543

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.

Published Jan 7, 2026 · updated Oct 14, 2026 · redhat build of apache camel

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 7, 2026 · NIST NVD

    Detected

    A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user session

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user session

Affected

  • cpe redhat/build of apache camelversion unspecified
  • cpe redhat/data grid8.0
  • cpe redhat/fuse7.0.0
  • cpe redhat/jboss enterprise application platformversion unspecified
  • cpe redhat/jboss enterprise application platform7.0.0
  • cpe redhat/jboss enterprise application platform expansion packversion unspecified

Sources

  • CVE.orgCVE-2025-12543

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2025-12543

    A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are

    nvd.nist.gov

References