Summary
It was discovered that Undertow incorrectly validated the Host header in
incoming HTTP requests. A remote attacker could possibly use this issue
to gain unintended access to user sessions.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | undertow | 1.3.16-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | undertow | 1.4.23-3ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | undertow | 2.0.29-1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | undertow | 2.2.16-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | undertow | 2.3.8-2ubuntu0.1~esm1 |
References
-
report
https://ubuntu.com/security/CVE-2025-12543