CVE-2025-12543: Undertow HTTP Server Core Host Header Validation Flaw
Summary
CVE-2025-12543: Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests. Affects io.undertow:undertow-core versions < 2.4.0.Alpha1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a flexible and performant web server written in Java, often used in conjunction with Java applications such as WildFly and JBoss EAP. It supports both blocking and non-blocking APIs and is designed to handle a large number of concurrent connections efficiently. However, a critical vulnerability has been identified in its handling of the Host header in incoming HTTP requests, which can lead to severe security issues.
Vulnerability Detail
A flaw in the Undertow HTTP server core allows it to improperly validate the Host header in incoming HTTP requests. This vulnerability can be exploited by attackers to send malformed or malicious Host headers, which may lead to cache poisoning, internal network scanning, or session hijacking. The failure to reject such requests poses a significant risk to applications relying on Undertow, making it crucial for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement a reverse proxy in front of your Undertow server that validates the Host header before forwarding requests. This can help mitigate the risk until a proper fix is applied.
Conclusion
The Undertow HTTP server core vulnerability (CVE-2025-12543) poses a significant risk due to improper validation of the Host header in HTTP requests. Users are strongly advised to update to the patched version to safeguard their applications against potential attacks.
See every vulnerability recorded for io.undertow:undertow-core →
FAQ
The CVSS score for this vulnerability is 9.6, indicating a critical level of severity.
Versions of Undertow core from 0 up to 2.4.0.Alpha1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's pom.xml with Vulert's playground at Vulert Scanner.
Exploiting this vulnerability can lead to cache poisoning, internal network scans, and session hijacking, compromising the security of your application.
Yes, a patch is available. Update to version 2.4.1 or later of the Undertow core package to mitigate this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for io.undertow:undertow-core.
