undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

🗓️ 18 Mar 2026 13:54:46Reported by RedHatType

redhat🔗 access.redhat.com👁 7 Views

Undertow core fails to validate Host header, enabling cache poisoning, scans, and session hijacking.

Reporter	Title	Published	Views	Family All 84
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by two Undertow vulnerabilities that could allow remote denial of service attacks and Host header manipulation leading to cache poisoning or session hijacking	23 Feb 202619:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Undertow	24 Mar 202619:29	–	ibm
IBM Security Bulletins	Security Bulletin: Improper Host Header Validation in Undertow HTTP Server Enables Cache Poisoning and Session Hijacking affects watsonx.data	9 Apr 202616:52	–	ibm
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Undertow server core	10 Apr 202614:17	–	ibm
ATTACKERKB	CVE-2025-12543	7 Jan 202616:04	–	attackerkb
BDU FSTEC	The vulnerability of the Undertow HTTP server’s kernel allows for attacks using SSRF, due to errors in the mechanism for processing input data when handling Host headers.	9 Jan 202600:00	–	bdu_fstec
Broadcom	Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVE-2025-12543)	26 Jan 202600:00	–	broadcom
Chainguard	CVE-2025-12543 vulnerabilities	27 Jan 202601:17	–	cgr
Circl	CVE-2025-12543	7 Jan 202616:56	–	circl
CNNVD	Red Hat Undertow 安全漏洞	7 Jan 202600:00	–	cnnvd

Vulners

Node

AND

redhat jboss_enterprise_application_platformRange<7.4

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-12543
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-12543
cve	www.cve.org/CVERecord

07 Aug 2026 18:03Current

7.6High risk

Vulners AI Score7.6

CVSS 3.19.6

EPSS0.012

SSVC

Undertow core Host header Cache poisoning Internal network scans Session hijacking WildFly JBoss