Undertow HTTP Server Used in Java Apps Vulnerability Allow Attackers to Hijack Sessions

Cybersecuritynews •Abinaya • January 9, 2026

A critical security flaw has been discovered in the Undertow HTTP server core, a widely used component in Java applications such as WildFly and JBoss EAP. The vulnerability, tracked as CVE-2025-12543, poses serious risks to application security by enabling attackers to hijack user sessions and compromise internal systems. The flaw exists in how Undertow handles HTTP […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Undertow HTTP Server Vulnerability Enables Session Hijacking in Java Apps A critical vulnerability, tracked as CVE-2025-12543, has been identified in the Undertow HTTP server, affecting Java applications like WildFly and JBoss EAP. This flaw allows attackers to hijack user sessions, leading to potential unauthorized access and compromise of internal systems. 2 sources 30

Extracted Entities

CVEs (1)

CVE-2025-12543

Platforms (4)

Java JBoss EAP Undertow WildFly