A flaw has been discovered in the foundation of the Java web ecosystem. Undertow , the high-performance web server that powers enterprise heavyweights like WildFly and JBoss EAP , has been hit by a critical security vulnerability.
Identified as CVE-2025-12543, this 9.6-score flaw allows attackers to exploit the HTTP Host header, opening the door to cache poisoning, internal reconnaissance, and session hijacking.
The vulnerability lies in the way the Undertow core processes incoming web traffic. In a standard HTTP request, the Host header tells the server which website the client is trying to reach. It serves as a routing label.
In short, Undertow fails to properly validate this header. Instead of rejecting malformed or malicious host input, the server processes it without question. The implications of this “Host Header Injection” are serious and multiple.
Security experts warn that this flaw can be exploited remotely without authentication, meaning an attacker doesn’t need prior access to launch an attack.
Although the severity is classified as “critical” due to the requirement for limited user interaction to achieve maximum impact (for example, tricking a user into clicking on an infected link), the enormous potential for damage pushes the CVSS score to near-maximum levels. The vulnerability directly affects the confidentiality and integrity of affected systems.
Because Undertow is designed to be embedded, it rarely runs alone. It is the default web server for WildFly (formerly JBoss AS) and JBoss Enterprise Application Platform (EAP), meaning this vulnerability is likely present in thousands of enterprise Java applications worldwide.
Follow us on Google News to receive daily updates on cybersecurity. Contact us if you would like to report news, insights or content for publication.
