kavin71725/cve-2025-12543-fix-for-wildflyDocker base image with backported Host header validation fix for CVE-2025-12543 in Undertow 1.4.x, enabling secure deployment of WildFly 11 applications.
This repository provides a Docker base image built on WildFly 11.0.0.Final with a backported fix for CVE-2025-12543, a critical Host header validation vulnerability in Undertow.
The image is intended to be provided to colleagues as a base. They can deploy their own .war application and standalone.xml on top of it.
| Field | Detail |
|---|
| CVE ID | CVE-2025-12543 |
| Component | io.undertow:undertow-core |
| Severity | Critical (CVSS 9.6) |
| Affected versions | All versions < 2.2.39 (including 1.4.x) |
| Fixed in | Undertow 2.2.39 / 2.3.22 |
| WildFly 11 version | undertow-core-1.4.18.Final — affected |
Undertow fails to properly validate the Host header in incoming HTTP requests. Requests containing malformed or malicious Host headers are processed without rejection, enabling:
Other users are still on WildFly 11, and there are no current resources or plans to upgrade. The fix was backported directly into the Undertow 1.4.18.Final JAR instead.
.
├── Dockerfile # Main image definition
├── README.md
├── wildfly-dist-11.0.0.Final.tar.gz # WildFly 11 distribution archive
├── reports/
│ ├── result-20260401-0230.txt # CVE scan report that identified the vulnerability
│ └── wildfly_11.0.0.Final_*.txt # Additional scan reports
└── patch/
├── src/
│ ├── HostHeaderHandler.java # Backported fix — new handler class
│ ├── HttpReadListener_only.java # Decompiled + patched HttpReadListener source (reference)
│ └── PatchHttpReadListener.java # Javassist bytecode patcher tool
├── build.sh # Build script — rebuilds the patched JAR from scratch
├── undertow-core-1.4.18.Final.jar # Original (unpatched) JAR — kept for reference
└── undertow-core-1.4.18.Final-patched.jar # Patched JAR injected into the image
DockerfileBuilds the final image. It:
bitnamilegacy/java:1.8.432-7-debian-12-r2 (OpenJDK 1.8.0_432) as the base/opt/jboss/wildflyundertow-core-1.4.18.Final.jar with the patched versionstandalone.sh -b 0.0.0.0 (binds to all interfaces)patch/undertow-core-1.4.18.Final-patched.jarThe patched Undertow JAR. It is identical to the original except for two changes:
io/undertow/server/handlers/HostHeaderHandler.class (and its inner classes)io/undertow/server/protocol/http/HttpReadListener.class — injects HostHeaderHandler into the request pipelinepatch/src/HostHeaderHandler.javaThe backported Host header validation handler. Ported from Undertow PR #1857 (UNDERTOW-2656).
All constants (IP4_EXACT, IP6_EXACT, character tables) are self-contained — no dependency on APIs added in Undertow 2.x. On every HTTP request, it validates:
400 Bad Request on any violationpatch/src/PatchHttpReadListener.javaA one-shot Javassist bytecode patcher. It loads HttpReadListener from the original JAR and replaces:
// Before
Connectors.executeRootHandler(connection.getRootHandler(), exchange);
// After
Connectors.executeRootHandler(
HostHeaderHandler.WRAPPER.wrap(connection.getRootHandler()),
exchange
);
This injects HostHeaderHandler automatically into every HTTP request, without requiring a full recompile of HttpReadListener (which depends on complex inner classes and xnio internals).
patch/src/HttpReadListener_only.javaDecompiled source of the original HttpReadListener from Undertow 1.4.18.Final, used as a reference to locate the injection point. The patched version of this source is also kept here for audit purposes.
reports/result-20260401-0230.txtCVE scan report (generated 2026-04-01) that identified CVE-2025-12543 in undertow-core-1.4.18.Final at:
/opt/jboss/wildfly/modules/system/layers/base/io/undertow/core/main/undertow-core-1.4.18.Final.jar
The scan report (result-20260401-0230.txt) confirmed undertow-core-1.4.18.Final is affected by CVE-2025-12543 (CVSS 9.6).
The fix is in Undertow PR #1857, merged into main (2026-01-09) and backported to 2.2.x and 2.3.x. The fix adds HostHeaderHandler.java and wires it into HttpReadListener to validate the Host header on every request.
Undertow 1.4.x → 2.2.x is a major version jump with breaking API changes. WildFly 11 is tightly coupled to Undertow 1.4.x via JBoss Modules. A direct JAR swap would cause ClassNotFoundException / NoSuchMethodError at startup.
HostHeaderHandler.javaWrite a self-contained version of HostHeaderHandler.java compatible with Undertow 1.4.18.Final:
IP4_EXACT, IP6_EXACT) — not available in 1.4.x NetworkUtilsexchange.isHostIncludedInRequestURI() — not available in 1.4.x HttpServerExchangeCompile against the Undertow 1.4.18 + xnio classpath inside the WildFly image:
javac -cp undertow-core-1.4.18.Final.jar:xnio-api-3.5.4.Final.jar:jboss-logging-3.3.1.Final.jar \
-d out HostHeaderHandler.java
HttpReadListener via JavassistDecompile HttpReadListener with Procyon to locate the injection point:
Connectors.executeRootHandler(this.connection.getRootHandler(), httpServerExchange);
located in handleEventWithNoRunningRequest().
Because HttpReadListener has anonymous inner classes ($1, $2, $3) that cannot be referenced from decompiled source, a full recompile is not feasible. Instead, use Javassist (PatchHttpReadListener.java) to instrument the bytecode directly — replacing the executeRootHandler call to wrap the root handler with HostHeaderHandler.WRAPPER.
java -cp javassist.jar:undertow-core-1.4.18.Final.jar:out \
PatchHttpReadListener undertow-core-1.4.18.Final.jar out/
Copy the original JAR and inject the patched/new class files:
cp undertow-core-1.4.18.Final.jar undertow-core-1.4.18.Final-patched.jar
jar uf undertow-core-1.4.18.Final-patched.jar \
-C out io/undertow/server/handlers/HostHeaderHandler.class \
-C out "io/undertow/server/handlers/HostHeaderHandler\$Wrapper.class" \
-C out "io/undertow/server/handlers/HostHeaderHandler\$1.class" \
-C out io/undertow/server/protocol/http/HttpReadListener.class
Add a COPY for the patched JAR and replace the original inside the image:
COPY patch/undertow-core-1.4.18.Final-patched.jar /tmp/
RUN cp /tmp/undertow-core-1.4.18.Final-patched.jar \
/opt/jboss/wildfly/modules/system/layers/base/io/undertow/core/main/undertow-core-1.4.18.Final.jar
docker build -t wildfly:11.0.0.Final-patched .
Validation:
# Valid Host header — should return 200
curl -v -H "Host: localhost:8080" http://localhost:8080/
# Bad characters in Host — should return 400 Host Header Bad Characters
curl -v -H "Host: evil<script>" http://localhost:8080/
# Duplicate Host headers — should return 400 Bad Request
# Note: curl deduplicates Host headers internally, so a raw TCP request is required for this test
exec 3<>/dev/tcp/localhost/8080; \
printf "GET / HTTP/1.1\r\nHost: localhost\r\nHost: evil.com\r\nConnection: close\r\n\r\n" >&3; \
sleep 1; head -1 <&3; exec 3>&-
# Port out of range — should return 400 Host Header Malformed Port
curl -v -H "Host: localhost:99999" http://localhost:8080/
| Request | Expected | Result |
|---|---|---|
Host: localhost:8080 (valid) | 200 OK | ✓ |
Host: evil<script> (bad chars) | 400 Host Header Bad Characters | ✓ |
Two Host: headers (duplicate, raw TCP) | 400 Bad Request | ✓ |
Host: localhost:99999 (bad port) | 400 Host Header Malformed Port | ✓ |
Host HeaderBefore this patch, WildFly's REQUIRE_HOST_HTTP11 option defaulted to false, meaning HTTP/1.1 requests without a Host header were silently accepted.
After this patch, the HostHeaderHandler enforces RFC 7230 strictly — all HTTP/1.1 requests without a Host header are rejected with 400 No Host Header, regardless of the REQUIRE_HOST_HTTP11 setting.
Who may be affected:
GET / HTTP/1.1 without a Host headerWhat to do:
Ensure all HTTP/1.1 clients include a Host header. This is already required by RFC 7230 and any standard HTTP library (curl, Java's HttpClient, etc.) does this automatically. Only non-compliant or very old custom clients are affected.
# This will now be rejected with 400:
GET /health HTTP/1.1
Connection: close
# This is correct and will work fine:
GET /health HTTP/1.1
Host: your-server:8080
Connection: close
If you need to regenerate patch/undertow-core-1.4.18.Final-patched.jar in a new environment (e.g., the pre-built JAR is unavailable), use the provided build script.
Requirements: Java 8 JDK, curl, internet access to Maven Central.
cd patch
bash build.sh
The script will:
HostHeaderHandler.javaPatchHttpReadListener.java to patch HttpReadListener bytecode via Javassistundertow-core-1.4.18.Final-patched.jarAfter it completes, proceed with docker build as normal.
Note:
wildfly-dist-11.0.0.Final.tar.gzis not included in this repository (exceeds GitHub's 100 MB limit). Download it from Maven Central before building:https://repo1.maven.org/maven2/org/wildfly/wildfly-dist/11.0.0.Final/wildfly-dist-11.0.0.Final.tar.gz
docker build -t wildfly:11.0.0.Final-patched .
docker run -d -p 8080:8080 wildfly:11.0.0.Final-patched
Colleagues can mount or extend the image with their own deployment:
FROM wildfly:11.0.0.Final-patched
COPY standalone.xml /opt/jboss/wildfly/standalone/configuration/standalone.xml
COPY myapp.war /opt/jboss/wildfly/standalone/deployments/