Quick answer
Direct answer
Risk scores
| CVSS metric | What it means |
|---|---|
| Attack vector (AV:N) | Network: reachable remotely |
| Attack complexity (AC:L) | Low complexity |
| Privileges required (PR:N) | No privileges required |
| User interaction (UI:R) | A user must take an action |
| Scope (S:C) | Scope changed: impact spreads beyond the component |
| Confidentiality (C:H) | High confidentiality impact |
| Integrity (I:H) | High integrity impact |
| Availability (A:L) | Low availability impact |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
About Redhat Build Of Apache Camel
CVE-2025-12543 affects Redhat Build Of Apache Camel, a product from Redhat. Before acting, confirm where Redhat Build Of Apache Camel runs in your estate, who owns it and whether it is reachable from the internet, because exposure decides real risk more than the score alone.
What the flaw is
In plain terms: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
The weakness class is Improper Input Validation. The software trusts input without checking it is safe.
Based on its CVSS vector, the flaw can be reached over the network, needs no login, and relies on a user taking an action. Apply the vendor fix and confirm exposure on internet facing and business critical assets first.
Affected versions and timeline
| Field | Detail |
|---|---|
| Product | Redhat Build Of Apache Camel |
| Affected versions | Build Of Apache Camel before 4.14.4; Data Grid 8.0; Fuse 7.0.0; Jboss Enterprise Application Platform from 8.0 before 8.0.12; Jboss Enterprise Application Platform from 8.1.0 before 8.1.3; Jboss Enterprise Application Platform all listed versions; Jboss Enterprise Application Platform 7.0.0; Jboss Enterprise Application Platform Expansion Pack all listed versions; Process Automation 7.0; Single Sign-On 7.0; Undertow before 2.2.39; Undertow from 2.3.0 before 2.3.21 |
| Published | Jan 7, 2026 |
| Last modified | Oct 14, 2026 |
| Added to CISA KEV | Not listed |
| Assigning CNA | secalert@redhat.com |
How to detect it
- Inventory every instance of Redhat Build Of Apache Camel and record the running version against the affected range above.
- Check external attack surface scans for internet facing instances of the component.
- Review logs on affected systems for unusual requests, errors or new processes around the vulnerable function.
- Confirm with an authenticated vulnerability scan once your scanner has a check for this CVE.
How to fix it
- Apply the fixed version of Redhat Build Of Apache Camel named in the vendor advisory.
- If patching must wait, restrict network access to the affected service and put it behind authentication or a web application firewall rule.
- Rescan after the change to prove the exposure is gone, then close the ticket.
CTEM action plan
| CTEM stage | What to do for this CVE |
|---|---|
| Scope | Add every business service that depends on Redhat Build Of Apache Camel to the current CTEM cycle. |
| Discover | Find all instances, including shadow and cloud deployments, and record versions and exposure. |
| Prioritize | Rank using EPSS and CVSS together with asset exposure and business impact. |
| Validate | Confirm the flaw is reachable and exploitable in your environment and that compensating controls work. |
| Mobilize | Assign the fix to the asset owner with a due date matched to the priority, then verify closure. |
CWE References
- CWE-20: Improper Input Validation More CVEs with this weakness
- CWE-20: Improper Input Validation More CVEs with this weakness
Technical References
- ▸NVD entry
- ▸CVE.org record
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
- ▸Red Hat security advisory
Frequently asked questions
Related CVEs
A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.
Earn your free CTEM certification.
Learn to scope, prioritize, validate and mobilize fixes for CVEs like CVE-2025-12543 with a free CTEM certification.
Beginner / Practitioner / Program Leader
Explore certifications