CVE-2025-12543
CriticalCVSS 9.6Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
The Undertow HTTP server library used in WildFly, JBoss EAP, and other Java applications does not properly validate the Host header, allowing malicious requests to be processed.
Risk Assessment
An attacker can poison caches, perform internal network scans, or hijack user sessions.
Recommendation
Upgrade Undertow to a version that includes the Host header validation fix.
Original NVD description (English source)
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.