Host Header Vulnerability in Undertow HTTP Server for WildFly and JBoss EAP
CVE-2025-12543

9.6CRITICAL

Key Information:

Vendor: Red Hat
Status: Red Hat Jboss Enterprise Application Platform 8.1; Red Hat Jboss Enterprise Application Platform 8.1 For Rhel 8; Red Hat Jboss Enterprise Application Platform 8.1 For Rhel 9; Red Hat Build Of Apache Camel For Spring Boot 4
Vendor: CVE Published:; 7 January 2026

What is CVE-2025-12543?

A flaw exists in the core of the Undertow HTTP server, utilized by WildFly and JBoss EAP. This vulnerability arises from inadequate validation of the Host header in incoming HTTP requests. Malicious or malformed Host headers are not properly rejected, allowing attackers to exploit this weakness. Consequently, they can poison caches, perform scans of internal networks, or hijack user sessions, posing serious security risks to affected applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch