Bug#1125059: undertow: CVE-2025-12543

[Moritz Mühlenhoff]

Source: undertow
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for undertow.

CVE-2025-12543[0]:
| A flaw was found in the Undertow HTTP server core, which is used in
| WildFly, JBoss EAP, and other Java applications. The Undertow
| library fails to properly validate the Host header in incoming HTTP
| requests.As a result, requests containing malformed or malicious
| Host headers are processed without rejection, enabling attackers to
| poison caches, perform internal network scans, or hijack user
| sessions.

https://bugzilla.redhat.com/show_bug.cgi?id=2408784
 

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-12543
    https://www.cve.org/CVERecord?id=CVE-2025-12543

Please adjust the affected versions in the BTS as needed.