Red Hat JBoss Enterprise Application Platform 8.1.3 includes security fixes for multiple vulnerabilities in the Undertow HTTP server component. Notably, CVE-2025-12543 addresses a failure to reject malformed Host headers, which could lead to cache poisoning and server-side request forgery (SSRF). Additional fixes include CVE-2024-3884, an OutOfMemory vulnerability when parsing application/x-www-form-urlencoded data, and CVE-2025-9784, an HTTP/2 denial-of-service vulnerability. These vulnerabilities affect Red Hat JBoss Enterprise Application Platform 8.1 versions prior to 8.1.3 on Red Hat Enterprise Linux 8 and 9. The update also upgrades related components such as Hibernate ORM, WildFly Elytron, Apache CXF, and others. The vendor advisory confirms the availability of patches and provides detailed instructions for applying the update.

The vulnerabilities fixed in this update could allow an attacker to perform cache poisoning and SSRF via malformed Host headers, cause denial of service through OutOfMemory conditions, or launch HTTP/2-based DDoS attacks against affected systems. These issues impact the stability and security of applications running on Red Hat JBoss Enterprise Application Platform 8.1 prior to 8.1.3. Exploitation could lead to service disruption and potential unauthorized access depending on the environment and application configuration.

Red Hat has released version 8.1.3 of JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 8 and 9, which includes fixes for these vulnerabilities. Users should apply this update promptly after ensuring all previous errata have been applied and after backing up their systems, including applications, configuration files, and databases. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated by the vendor advisory.