CVE-2025-12543: Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

— NVD

An Improper Input Validation vulnerability exists in the Undertow HTTP server (io.undertow:undertow-core) where the implementation does not return a 400 Bad Request response when receiving requests with invalid or malformed Host headers. The flaw can be exploited by remote attackers via specially crafted HTTP requests. Depending on the deployment, the issue enables web cache poisoning, session hijacking, or server-side request forgery (SSRF). Attackers may inject malicious responses into caches, steal authentication tokens, or redirect users to malicious endpoints. Successful exploitation can result in complete account takeover, widespread credential theft, or unauthorized access to internal network resources, thereby compromising confidentiality and integrity of user data.

— Red Hat

Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. An attacker could exploit this vulnerability using a method call to obtain sensitive information.

— IBM