Undertow HTTP Server Vulnerability Allows Attackers to Hijack Sessions in Java Apps

Cyberpress • January 9, 2026

Share: View original

The vulnerability , tracked as CVE-2025-12543, exposes users to session hijacking, cache poisoning, and unauthorized network reconnaissance ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Undertow HTTP Server Vulnerability Enables Session Hijacking in Java Apps A critical vulnerability, tracked as CVE-2025-12543, has been identified in the Undertow HTTP server, affecting Java applications like WildFly and JBoss EAP. This flaw allows attackers to hijack user sessions, leading to potential unauthorized access and compromise of internal systems. 2 sources 30

Extracted Entities

CVEs (1)

Platforms (1)

Undertow HTTP Server