WildFly 11.0.0.Final Base Image — CVE-2025-12543 Patch

Overview

This repository provides a Docker base image built on WildFly 11.0.0.Final with a backported fix for CVE-2025-12543, a critical Host header validation vulnerability in Undertow.

The image is intended to be provided to colleagues as a base. They can deploy their own .war application and standalone.xml on top of it.

---

CVE-2025-12543 Summary

Field	Detail
CVE ID	CVE-2025-12543
Component	io.undertow:undertow-core
Severity	Critical (CVSS 9.6)
Affected versions	All versions < 2.2.39 (including 1.4.x)
Fixed in	Undertow 2.2.39 / 2.3.22
WildFly 11 version	undertow-core-1.4.18.Final — affected

Vulnerability Description

Undertow fails to properly validate the Host header in incoming HTTP requests. Requests containing malformed or malicious Host headers are processed without rejection, enabling:

• Cache poisoning
• Session hijacking
• Internal network scanning
• Cross-tenant data mixing / trust-boundary bypasses

Why Not Upgrade WildFly?

Other users are still on WildFly 11, and there are no current resources or plans to upgrade. The fix was backported directly into the Undertow 1.4.18.Final JAR instead.

---

Repository Structure

.
├── Dockerfile                                  # Main image definition
├── README.md
├── wildfly-dist-11.0.0.Final.tar.gz           # WildFly 11 distribution archive
├── reports/
│   ├── result-20260401-0230.txt               # CVE scan report that identified the vulnerability
│   └── wildfly_11.0.0.Final_*.txt             # Additional scan reports
└── patch/
    ├── src/
    │   ├── HostHeaderHandler.java             # Backported fix — new handler class
    │   ├── HttpReadListener_only.java         # Decompiled + patched HttpReadListener source (reference)
    │   └── PatchHttpReadListener.java         # Javassist bytecode patcher tool
    ├── build.sh                               # Build script — rebuilds the patched JAR from scratch
    ├── undertow-core-1.4.18.Final.jar         # Original (unpatched) JAR — kept for reference
    └── undertow-core-1.4.18.Final-patched.jar # Patched JAR injected into the image

File Details

Dockerfile

Builds the final image. It:

1. Uses bitnamilegacy/java:1.8.432-7-debian-12-r2 (OpenJDK 1.8.0_432) as the base
2. Extracts WildFly 11 into /opt/jboss/wildfly
3. Replaces the original undertow-core-1.4.18.Final.jar with the patched version
4. Starts WildFly via standalone.sh -b 0.0.0.0 (binds to all interfaces)

patch/undertow-core-1.4.18.Final-patched.jar

The patched Undertow JAR. It is identical to the original except for two changes:

• Added: io/undertow/server/handlers/HostHeaderHandler.class (and its inner classes)
• Modified: io/undertow/server/protocol/http/HttpReadListener.class — injects HostHeaderHandler into the request pipeline

patch/src/HostHeaderHandler.java

The backported Host header validation handler. Ported from Undertow PR #1857 (UNDERTOW-2656).

All constants (IP4_EXACT, IP6_EXACT, character tables) are self-contained — no dependency on APIs added in Undertow 2.x. On every HTTP request, it validates:

• Host header is present (required for HTTP/1.1)
• Exactly one Host header (no duplicates)
• Port is numeric and in range 1–65535
• IP literals (IPv4, IPv6, IPvFuture) are well-formed
• Hostname characters are valid RFC 3986 reg-name characters
• Rejects with 400 Bad Request on any violation

patch/src/PatchHttpReadListener.java

A one-shot Javassist bytecode patcher. It loads HttpReadListener from the original JAR and replaces:

// Before
Connectors.executeRootHandler(connection.getRootHandler(), exchange);

// After
Connectors.executeRootHandler(
    HostHeaderHandler.WRAPPER.wrap(connection.getRootHandler()),
    exchange
);

This injects HostHeaderHandler automatically into every HTTP request, without requiring a full recompile of HttpReadListener (which depends on complex inner classes and xnio internals).

patch/src/HttpReadListener_only.java

Decompiled source of the original HttpReadListener from Undertow 1.4.18.Final, used as a reference to locate the injection point. The patched version of this source is also kept here for audit purposes.

reports/result-20260401-0230.txt

CVE scan report (generated 2026-04-01) that identified CVE-2025-12543 in undertow-core-1.4.18.Final at:

/opt/jboss/wildfly/modules/system/layers/base/io/undertow/core/main/undertow-core-1.4.18.Final.jar

---

Patch Procedure

1. Identify the vulnerability

The scan report (result-20260401-0230.txt) confirmed undertow-core-1.4.18.Final is affected by CVE-2025-12543 (CVSS 9.6).

2. Research the upstream fix

The fix is in Undertow PR #1857, merged into main (2026-01-09) and backported to 2.2.x and 2.3.x. The fix adds HostHeaderHandler.java and wires it into HttpReadListener to validate the Host header on every request.

3. Assess direct upgrade feasibility

Undertow 1.4.x → 2.2.x is a major version jump with breaking API changes. WildFly 11 is tightly coupled to Undertow 1.4.x via JBoss Modules. A direct JAR swap would cause ClassNotFoundException / NoSuchMethodError at startup.

4. Backport HostHeaderHandler.java

Write a self-contained version of HostHeaderHandler.java compatible with Undertow 1.4.18.Final:

• Inline all regex constants (IP4_EXACT, IP6_EXACT) — not available in 1.4.x NetworkUtils
• Remove exchange.isHostIncludedInRequestURI() — not available in 1.4.x HttpServerExchange
• Keep all validation logic identical to the upstream fix

Compile against the Undertow 1.4.18 + xnio classpath inside the WildFly image:

javac -cp undertow-core-1.4.18.Final.jar:xnio-api-3.5.4.Final.jar:jboss-logging-3.3.1.Final.jar \
      -d out HostHeaderHandler.java

5. Patch HttpReadListener via Javassist

Decompile HttpReadListener with Procyon to locate the injection point:

Connectors.executeRootHandler(this.connection.getRootHandler(), httpServerExchange);

located in handleEventWithNoRunningRequest().

Because HttpReadListener has anonymous inner classes ($1, $2, $3) that cannot be referenced from decompiled source, a full recompile is not feasible. Instead, use Javassist (PatchHttpReadListener.java) to instrument the bytecode directly — replacing the executeRootHandler call to wrap the root handler with HostHeaderHandler.WRAPPER.

java -cp javassist.jar:undertow-core-1.4.18.Final.jar:out \
     PatchHttpReadListener undertow-core-1.4.18.Final.jar out/

6. Repackage the JAR

Copy the original JAR and inject the patched/new class files:

cp undertow-core-1.4.18.Final.jar undertow-core-1.4.18.Final-patched.jar
jar uf undertow-core-1.4.18.Final-patched.jar \
    -C out io/undertow/server/handlers/HostHeaderHandler.class \
    -C out "io/undertow/server/handlers/HostHeaderHandler\$Wrapper.class" \
    -C out "io/undertow/server/handlers/HostHeaderHandler\$1.class" \
    -C out io/undertow/server/protocol/http/HttpReadListener.class

7. Update the Dockerfile

Add a COPY for the patched JAR and replace the original inside the image:

COPY patch/undertow-core-1.4.18.Final-patched.jar /tmp/
RUN cp /tmp/undertow-core-1.4.18.Final-patched.jar \
       /opt/jboss/wildfly/modules/system/layers/base/io/undertow/core/main/undertow-core-1.4.18.Final.jar

8. Build and validate

docker build -t wildfly:11.0.0.Final-patched .

Validation:

# Valid Host header — should return 200
curl -v -H "Host: localhost:8080" http://localhost:8080/