Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Summary

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Timeline

1. Jan 7, 2026, 12:00 AM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: total

2. Jan 7, 2026, 4:04 PM UTCCVE published
3. Oct 14, 2026, 4:28 PM UTCRecord last updated

Affected versions

• undertow-core

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-undertow

  Version range not reported

• io.undertow/undertow-core

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-wildfly

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-wildfly

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-wildfly

  Version range not reported

• undertow-core

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-guava-libraries

  Version range not reported

• eap8-jaxb

  Version range not reported

• eap8-jcip-annotations

  Version range not reported

• eap8-slf4j-jboss-logmanager

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-guava-libraries

  Version range not reported

• eap8-jaxb

  Version range not reported

• eap8-jcip-annotations

  Version range not reported

• eap8-slf4j-jboss-logmanager

  Version range not reported

• eap8-undertow

  Version range not reported

• io.undertow/undertow-core

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-eventstream

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-jboss-el-api_5.0_spec

  Version range not reported

• eap8-jboss-threads

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-clustering

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-eventstream

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-jboss-el-api_5.0_spec

  Version range not reported

• eap8-jboss-threads

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-clustering

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• undertow-core

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso-7/sso76-openshift-rhel8

  Version range not reported

• undertow-core

  Version range not reported

• undertow-core

  Version range not reported

• moditect

  Version range not reported

• pki-core:10.6/resteasy

  Version range not reported

• pki-deps:10.6/resteasy

  Version range not reported

• resteasy

  Version range not reported

• undertow-core

  Version range not reported

• undertow-core

  Version range not reported

• undertow-core

  Version range not reported

• undertow-core

  Version range not reported

• io.undertow:undertow-coreMaven

  2.4.0.Alpha1

• io.undertow:undertow-coreMaven

  From 2.3.0.Alpha1 · fixed in 2.3.21.Final

• io.undertow:undertow-coreMaven

  fixed in 2.2.39.Final

References 20