CVE-2025-12543

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

CVSS 9.6 CRITICALEPSS 1.2%CWE-20

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.6EPSS 1.2%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Lifecycle

07 Jan 2026Published on NVD

01 Apr 2026Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Affected products

public PoCs found — 1

githubgithub.com/kavin71725/CVE-2025-12543-Fix-for-Wildfly★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References