{"action":"Upgrade io.undertow:undertow-core to 2.2.39.Final (2.2.x) or 2.3.21.Final (2.3.x) or later.","affected":[{"fixed":"2.3.21.Final","introduced":"2.3.0.Alpha1"},{"fixed":"2.2.39.Final","introduced":"0"}],"component":"io.undertow:undertow-core","cve_ids":["CVE-2025-12543"],"ecosystem":"Maven","epss":0.01333,"exploited":false,"fixed_versions":["2.3.21.Final","2.2.39.Final"],"ghsa_id":"GHSA-j382-5jj3-vw4j","id":"tcs_01M5N91VZ1ZSRCNWJJ3Y3PQBZN","modified_at":"2026-09-10T03:50:33.364740627Z","published_at":"2026-01-07T18:30:25Z","references":["https://osv.dev/vulnerability/GHSA-j382-5jj3-vw4j","https://nvd.nist.gov/vuln/detail/CVE-2025-12543","https://github.com/undertow-io/undertow/pull/1860","https://github.com/undertow-io/undertow/pull/1857","https://issues.redhat.com/browse/UNDERTOW-2656","https://github.com/undertow-io/undertow/releases/tag/2.3.21.Final","https://github.com/undertow-io/undertow/releases/tag/2.2.39.Final","https://github.com/undertow-io/undertow","https://bugzilla.redhat.com/show_bug.cgi?id=2408784","https://access.redhat.com/security/cve/CVE-2025-12543","https://access.redhat.com/errata/RHSA-2026:4924","https://access.redhat.com/errata/RHSA-2026:4917","https://access.redhat.com/errata/RHSA-2026:4916","https://access.redhat.com/errata/RHSA-2026:4915","https://access.redhat.com/errata/RHSA-2026:3892","https://access.redhat.com/errata/RHSA-2026:3891","https://access.redhat.com/errata/RHSA-2026:3890","https://access.redhat.com/errata/RHSA-2026:3889","https://access.redhat.com/errata/RHSA-2026:0386","https://access.redhat.com/errata/RHSA-2026:0384","https://access.redhat.com/errata/RHSA-2026:0383"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-j382-5jj3-vw4j","url":"https://osv.dev/vulnerability/GHSA-j382-5jj3-vw4j"}],"summary":"Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests"}