Cyber Posture

CVE-2025-12543

Critical

Published: 07 January 2026

Published
07 January 2026
Modified
18 March 2026
KEV Added
Patch
CVSS Score 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
EPSS Score 0.0005 15.6th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-12543 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Redhat Jboss Enterprise Application Platform. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the CVE's core issue of improper Host header validation by enforcing checks on incoming HTTP request inputs to reject malformed or malicious headers.

prevent

Mitigates the vulnerability through timely flaw remediation by applying vendor patches like Red Hat errata to fix the Undertow library's Host header processing defect.

prevent

Boundary protection at network perimeters, such as WAFs, can inspect and block requests with anomalous Host headers before they reach the vulnerable Undertow server.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Directly exploitable public-facing web server flaw via malicious Host headers, enabling cache poisoning and related attacks as described.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed…

more

or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Deeper analysisAI

CVE-2025-12543 is a vulnerability in the Undertow HTTP server core, which powers WildFly, JBoss EAP, and other Java applications. The flaw arises from the Undertow library's failure to properly validate the Host header in incoming HTTP requests, allowing malformed or malicious Host headers to be processed without rejection. Published on 2026-01-07, it is rated at CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) and linked to CWE-20 (Improper Input Validation).

Remote attackers require no privileges and can exploit this over the network with low attack complexity, though user interaction is needed. Exploitation enables cache poisoning, internal network scanning, or user session hijacking by tricking users into interacting with crafted requests that bypass Host header checks.

Red Hat has released multiple errata addressing the issue, including RHSA-2026:0383, RHSA-2026:0384, RHSA-2026:0386, RHSA-2026:3889, and RHSA-2026:3890, which provide updated packages and mitigation recommendations for affected WildFly, JBoss EAP, and related deployments.

Details

CWE(s)

Affected Products

redhat
build of apache camel
≤ 4.14.4
redhat
data grid
8.0
redhat
fuse
7.0.0
redhat
jboss enterprise application platform
7.0.0, all versions · 8.0 — 8.0.12 · 8.1.0 — 8.1.3
redhat
jboss enterprise application platform expansion pack
all versions
redhat
process automation
7.0
redhat
single sign-on
7.0
redhat
undertow
≤ 2.2.39 · 2.3.0 — 2.3.21

CVEs Like This One

CVE-2026-28367Same product: Redhat Data Grid
CVE-2026-28368Same product: Redhat Data Grid
CVE-2026-28369Same product: Redhat Data Grid
CVE-2026-3260Same product: Redhat Data Grid
CVE-2026-3009Same product: Redhat Jboss Enterprise Application Platform
CVE-2026-32590Same vendor: Redhat
CVE-2026-3121Same product: Redhat Jboss Enterprise Application Platform
CVE-2026-20856Shared CWE-20
CVE-2025-1736Shared CWE-20
CVE-2025-67484Shared CWE-20

References