Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2025-12543

critical

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.

Vendor / product: Redhat — build of apache camel

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

CVSS
9.6
9.6 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-01-07 17:15
Modified: 2026-10-14 17:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

redhat / build_of_apache_camel <4.14.4
redhat / data_grid 8.0
redhat / fuse 7.0.0
redhat / jboss_enterprise_application_platform ≥8.0 <8.0.12, ≥8.1.0 <8.1.3, all versions, 7.0.0
redhat / jboss_enterprise_application_platform_expansion_pack all versions
redhat / process_automation 7.0
redhat / single_sign-on 7.0
redhat / undertow <2.2.39, ≥2.3.0 <2.3.21

Weakness classification (CWE)

CWE-20

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://access.redhat.com/errata/RHSA-2026:0383
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:0384
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:0386
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:3889
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:3890
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:3891
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:3892
Vendor advisory: https://access.redhat.com/security/cve/CVE-2025-12543
Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2408784
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:0383

References

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-71226CVE-2026-28367CVE-2025-6170CVE-2026-58015CVE-2026-58013