GitHub Advisoryadvisory · Maven

GHSA-j382-5jj3-vw4j Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

CRITICAL Published 2026-01-07 Modified 2026-03-18 Official page ↗
Aliases
CVE-2025-12543
Ecosystem
Maven
Packages
io.undertow:undertow-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Weaknesses
CWE-20
Reviewed
2026-01-08

Affected packages

• Maven io.undertow:undertow-core: 2.4.0.Alpha1 (no fix yet) • Maven io.undertow:undertow-core: >= 2.3.0.Alpha1, < 2.3.21.Final → fixed in 2.3.21.Final • Maven io.undertow:undertow-core: < 2.2.39.Final → fixed in 2.2.39.Final

Description

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Related

Alias · CVE (1)

  • CVE-2025-12543 A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References