Description
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.24 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1.3 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6.13 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | 2.3.20-1ubuntu1 | — |
| Ubuntu 26.04 LTS | undertow | 2.3.20-1ubuntu1 | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | 2.3.8-2ubuntu0.1~esm1 | — |
| Ubuntu Pro 22.04 LTS | undertow | 2.2.16-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 20.04 LTS | undertow | 2.0.29-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 18.04 LTS | undertow | 1.4.23-3ubuntu0.1~esm1 | — |
| Ubuntu Pro 16.04 LTS | undertow | 1.3.16-1ubuntu0.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.20-1.redhat_00001.1.el7sso | RHSA-2026:76130, RHSA-2026:76129, RHSA-2026:76128 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-7.redhat_00007.1.ep7.el7 | RHSA-2026:33372, RHSA-2026:33371 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-21.SP19_redhat_00001.1.ep7.el7 | RHSA-2026:33372, RHSA-2026:33371 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +4 | 7.3.18-3.GA_redhat_00001.1.el7eap | RHSA-2026:33371 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-apache-cxf +3 | 3.5.11-1.SP1_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-eclipse-jgit | 5.13.5.202508271544-2.r_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-hibernate +4 | 5.3.38-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-marshalling +1 | 2.0.16-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-netty +26 | 4.1.124-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-undertow | 2.2.39-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly +4 | 7.4.24-4.GA_redhat_00002.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly-java-jdk17 | 7.4.24-4.GA_redhat_00002.1.el8eap | RHSA-2026:4917, RHSA-2026:4916 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.0.10-1.redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.82.0-1.redhat_00001.1.el8eap | RHSA-2026:3891, RHSA-2026:3889, RHSA-2026:0384 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.3.0-1.GA_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-eventstream | 1.0.1-3.redhat_00003.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-guava +1 | 33.0.0-2.jre_redhat_00003.1.el8eap | RHSA-2026:3891, RHSA-2026:3889 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.6.36-1.Final_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-jaxb +9 | 4.0.6-1.redhat_00001.1.el8eap | RHSA-2026:3891, RHSA-2026:3889 |
| Red Hat JBoss EAP 8 | eap8-jboss-el-api_5.0_spec | 4.0.2-1.Final_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-jboss-threads | 2.5.0-1.redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-jcip-annotations | 1.0.0-3.redhat_00009.1.el8eap | RHSA-2026:3891, RHSA-2026:3889 |
| Red Hat JBoss EAP 8 | eap8-slf4j-jboss-logmanager | 2.0.2-1.Final_redhat_00001.1.el8eap | RHSA-2026:3891, RHSA-2026:3889 |
| Red Hat JBoss EAP 8 | eap8-undertow | 2.3.20-2.SP4_redhat_00001.1.el8eap | RHSA-2026:3891, RHSA-2026:3889, RHSA-2026:0384 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.3-4.GA_redhat_00006.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-wildfly-clustering +19 | 5.0.12-1.Final_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-wildfly-elytron +1 | 2.6.6-1.Final_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-4.GA_redhat_00007.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | wildfly-openjdk-17 +1 | 39.0.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | 2.4.0.Alpha1 | — | GHSA-j382-5jj3-vw4j |
| Maven | io.undertow:undertow-core | >= 2.3.0.Alpha1, < 2.3.21.Final | 2.3.21.Final | GHSA-j382-5jj3-vw4j |
| Maven | io.undertow:undertow-core | < 2.2.39.Final | 2.2.39.Final | GHSA-j382-5jj3-vw4j |
Advisories 14
- RHSA-2026:76130 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76129 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76128 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4917 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4916 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4915 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:33371 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.18 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:3891 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.12 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:3889 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.12 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:33372 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.15 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:0384 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:0383 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-0054 Red Hat JBoss Enterprise Application Platform (Undertow): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
References
- RHSA-2026:0383 vendor-advisory
- RHSA-2026:0384 vendor-advisory
- RHSA-2026:0386 vendor-advisory
- RHSA-2026:33371 vendor-advisory
- RHSA-2026:33372 vendor-advisory
- RHSA-2026:3889 vendor-advisory
- RHSA-2026:3890 vendor-advisory
- RHSA-2026:3891 vendor-advisory
- RHSA-2026:3892 vendor-advisory
- RHSA-2026:4915 vendor-advisory
- RHSA-2026:4916 vendor-advisory
- RHSA-2026:4917 vendor-advisory
- RHSA-2026:4924 vendor-advisory
- RHSA-2026:76128 vendor-advisory
- RHSA-2026:76129 vendor-advisory
- RHSA-2026:76130 vendor-advisory
- RHSA-2026:76132 vendor-advisory
- RHSA-2026:76134 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-12543 vdb-entry
- RHBZ#2408784 issue-tracking