Undertow HTTP Server - Malformed Host Header Cache Poisoning
Title source: manualExploitation Summary
EIP tracks 1 public exploit for CVE-2025-12543. PoCs published by kavin71725.
AI-analyzed exploit summary This repository provides a detailed technical analysis and backported fix for CVE-2025-12543, a critical Host header validation vulnerability in Undertow. It includes a patched JAR, Dockerfile, and comprehensive documentation explaining the vulnerability, patching process, and validation logic.
Description
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
Exploits (1)
This repository provides a detailed technical analysis and backported fix for CVE-2025-12543, a critical Host header validation vulnerability in Undertow. It includes a patched JAR, Dockerfile, and comprehensive documentation explaining the vulnerability, patching process, and validation logic.
References (13)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L