Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.12 security update

Fixed packages 21

Vulnerabilities 3

• Critical 9.6
  CVE-2025-12543

  Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

  A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malici…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Wolfi Maven
  Jan 7, 2026
• High 7.5
  CVE-2024-3884

  Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

  A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will caus…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Wolfi Maven
  Dec 3, 2025
• High 7.5
  CVE-2025-9784 Public exploit

  Undertow: undertow madeyoureset http/2 ddos vulnerability

  A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeate…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Wolfi Maven
  Sep 2, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.0/index
• article
  https://access.redhat.com/articles/7120566
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275287
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2392306
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2408784
• article
  https://issues.redhat.com/browse/JBEAP-31073
• article
  https://issues.redhat.com/browse/JBEAP-31251
• article
  https://issues.redhat.com/browse/JBEAP-31325
• article
  https://issues.redhat.com/browse/JBEAP-31343
• article
  https://issues.redhat.com/browse/JBEAP-31358
• article
  https://issues.redhat.com/browse/JBEAP-31397
• article
  https://issues.redhat.com/browse/JBEAP-31420
• article
  https://issues.redhat.com/browse/JBEAP-31438
• article
  https://issues.redhat.com/browse/JBEAP-31446
• article
  https://issues.redhat.com/browse/JBEAP-31453
• article
  https://issues.redhat.com/browse/JBEAP-31566
• article
  https://issues.redhat.com/browse/JBEAP-31579
• article
  https://issues.redhat.com/browse/JBEAP-31596
• article
  https://issues.redhat.com/browse/JBEAP-31679
• article
  https://issues.redhat.com/browse/JBEAP-31708
• article
  https://issues.redhat.com/browse/JBEAP-31712
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3891.json
• report
  https://access.redhat.com/security/cve/CVE-2024-3884
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3884
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3884
• report
  https://access.redhat.com/security/cve/CVE-2025-9784
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-9784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-9784
• article
  https://github.com/undertow-io/undertow/pull/1778
• article
  https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final
• article
  https://issues.redhat.com/browse/UNDERTOW-2598
• article
  https://kb.cert.org/vuls/id/767506
• report
  https://access.redhat.com/security/cve/CVE-2025-12543
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-12543
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-12543