CVE-2025-12543
Published: 07 January 2026
Summary
CVE-2025-12543 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Redhat Jboss Enterprise Application Platform. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-12543 is a vulnerability in the Undertow HTTP server core, which powers WildFly, JBoss EAP, and other Java applications. The flaw arises from the Undertow library's failure to properly validate the Host header in incoming HTTP requests, allowing malformed or malicious Host headers to be processed without rejection. Published on 2026-01-07, it is rated at CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) and linked to CWE-20 (Improper Input Validation).
Remote attackers require no privileges and can exploit this over the network with low attack complexity, though user interaction is needed. Exploitation enables cache poisoning, internal network scanning, or user session hijacking by tricking users into interacting with crafted requests that bypass Host header checks.
Red Hat has released multiple errata addressing the issue, including RHSA-2026:0383, RHSA-2026:0384, RHSA-2026:0386, RHSA-2026:3889, and RHSA-2026:3890, which provide updated packages and mitigation recommendations for affected WildFly, JBoss EAP, and related deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1207
Vulnerability details
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed…
more
or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly exploitable public-facing web server flaw via malicious Host headers, enabling cache poisoning and related attacks as described.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE's core issue of improper Host header validation by enforcing checks on incoming HTTP request inputs to reject malformed or malicious headers.
Mitigates the vulnerability through timely flaw remediation by applying vendor patches like Red Hat errata to fix the Undertow library's Host header processing defect.
Boundary protection at network perimeters, such as WAFs, can inspect and block requests with anomalous Host headers before they reach the vulnerable Undertow server.