CVE-2025-12543-Fix-for-Wildfly

WildFly 11.0.0.Final Base Image — CVE-2025-12543 Patch Overview This repository provides a Docker base image built on WildFly 11.0.0.Final with a backported fix for CVE-2025-12543 , a critical Host header validation vulnerability in Undertow. The image is intended to be provided to colleagues as ...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Undertow server core

Summary Due to use of Undertow, DevOps Test Performance and Rational Performance Tester contain a potential improper input validation vulnerability. CVE-2025-12543 Vulnerability Details CVEID:CVE-2025-12543 DESCRIPTION: A flaw was found in the Undertow HTTP server core, which is used in WildFly,...

Security Bulletin: Improper Host Header Validation in Undertow HTTP Server Enables Cache Poisoning and Session Hijacking affects watsonx.data

Summary A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Undertow

Summary Multiple vulnerabilities in Undertow that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2024-3884 DESCRIPTION: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.24 (RHSA-2026:4915)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4915 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.0.12 (RHSA-2026:3889)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3889 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release o...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.12 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.0 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2025-12543 vulnerabilities

Vulnerabilities for packages: wildfly...

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVE-2025-12543)

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed withou...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.3 (RHSA-2026:0383)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0383 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release o...

io.undertow:undertow-servlet (1.0.0.beta33), io.undertow:undertow-websockets-jsr (1.0.0.beta33) +2 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.0.0.beta33)

io.undertow:undertow-core MAVEN version 1.0.0.beta33 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta33 - io.undertow:undertow-websockets-jsr 1.0.0.beta33 -...

com.sksamuel.scruffy:scruffy-integrationtest_2.10 (>=1.12.3, <=1.14.0), com.sksamuel.scruffy:scruffy-integrationtest_2.11 (>=1.12.3, <=1.14.0) +56 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.2.6.final)

io.undertow:undertow-core MAVEN version 1.2.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.sksamuel.scruffy:scruffy-integrationtest2.10 =1.12.3, =1.12.3, =1.12.3, =1.12.3, =1.12.3, =1.12.3,...

ch.digitalfondue.stampo:ch.digitalfondue.stampo.gradle.plugin (0.0.3), ch.digitalfondue.stampo:stampo (>=1.1, <=1.2.1) +76 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.2.7.final)

io.undertow:undertow-core MAVEN version 1.2.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - ch.digitalfondue.stampo:ch.digitalfondue.stampo.gradle.plugin 0.0.3 - ch.digitalfondue.stampo:stampo...

com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (1.0.1), de.svenkubiak:mangooio-hibernate-extension (1.0.0) +72 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.2.9.final)

io.undertow:undertow-core MAVEN version 1.2.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service 1.0.1 -...

co.paralleluniverse:comsat-actors-undertow (0.5.0), co.paralleluniverse:comsat-test-utils (0.5.0) +30 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.2.10.final)

io.undertow:undertow-core MAVEN version 1.2.10.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - co.paralleluniverse:comsat-actors-undertow 0.5.0 - co.paralleluniverse:comsat-test-utils 0.5.0 -...

io.mangoo:mangooio-core (>=1.1.0-rc1, <=1.1.0-rc2), io.mangoo:mangooio-integration-test (>=1.1.0-rc1, <=1.1.0-rc2) +10 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.2.11.final)

io.undertow:undertow-core MAVEN version 1.2.11.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.mangoo:mangooio-core =1.1.0-rc1, =1.1.0-rc1, =1.1.0-rc1, =1.1.0-rc1, =2.1.0, =15.11.1, =15.11.1,...

io.undertow:undertow-http2-test-suite (1.3.0.beta1), io.undertow:undertow-servlet (1.3.0.beta1) +2 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.3.0.beta1)

io.undertow:undertow-core MAVEN version 1.3.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta1 - io.undertow:undertow-servlet 1.3.0.beta1 -...

io.undertow:undertow-http2-test-suite (1.3.0.beta13), io.undertow:undertow-servlet (1.3.0.beta13) +20 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.3.0.beta13)

io.undertow:undertow-core MAVEN version 1.3.0.beta13 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta13 - io.undertow:undertow-servlet 1.3.0.beta13 -...

com.thehellings.gully:gully (0.4), com.thehellings:gully (0.5) +57 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.3.0.final)

io.undertow:undertow-core MAVEN version 1.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.thehellings.gully:gully 0.4 - com.thehellings:gully 0.5 - de.svenkubiak:mangooio-hibernate-extensio...

io.undertow:undertow-http2-test-suite (1.3.4.final), io.undertow:undertow-servlet (1.3.4.final) +19 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.3.4.final)

io.undertow:undertow-core MAVEN version 1.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.4.final - io.undertow:undertow-servlet 1.3.4.final -...