CVE-2025-12799 Overview
CVE-2025-12799 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in Jastow, a servlet container fork used in embedded deployments alongside Undertow. The flaw allows attackers to inject malicious script content through improperly handled URL characters. Exploitation requires a specific combined configuration that permits unescaped characters in URLs when Jastow runs with embedded Undertow. Under this configuration, the server processes attacker-controlled input without adequate sanitization, enabling script execution in the context of downstream users or applications. Red Hat has published multiple security advisories tracking affected product streams and released fixes across supported channels.
Critical Impact
Successful exploitation enables attackers to inject arbitrary scripts that execute in a victim's browser context, potentially leading to session compromise, credential theft, or unauthorized actions against the affected application.
Affected Products
- Jastow servlet container (embedded configurations)
- Undertow web server when integrated with Jastow using URL-permissive settings
- Red Hat products referenced in advisories RHSA-2026:36342 through RHSA-2026:36345
Discovery Timeline
- 2026-07-07 - CVE-2025-12799 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2025-12799
Vulnerability Analysis
The vulnerability resides in how Jastow handles URL input when deployed with embedded Undertow under a permissive character configuration. Applications that opt into allowing unescaped characters in request URLs bypass default input hardening. Attacker-supplied content in URL components can therefore reach response rendering paths without being neutralized. When that content is reflected into HTML output, the browser interprets it as executable script rather than data. The Common Weakness Enumeration category [CWE-79] describes this class of failure as improper neutralization of input during web page generation.
Root Cause
The root cause is improper input handling within Jastow when combined configuration options relax URL character restrictions. Jastow does not enforce contextual output encoding for characters that Undertow permits through the relaxed parser. The mismatch between the transport-layer configuration and the servlet-layer sanitization creates the injection sink.
Attack Vector
The attack vector is network-based and requires no authentication or user privileges. An attacker crafts a URL containing script payload characters and delivers it to a victim through phishing, embedded links, or malicious redirects. When the target application processes the URL, the injected content executes within the origin of the vulnerable service. The high attack complexity reflects the specific configuration prerequisite: the server must have unescaped URL characters explicitly enabled.
No verified proof-of-concept code is publicly available. See the Red Hat CVE Analysis for CVE-2025-12799 for vendor-side technical detail.
Detection Methods for CVE-2025-12799
Indicators of Compromise
- HTTP request logs containing unescaped angle brackets, quotes, or script tokens within URL paths or query parameters
- Reflected script content in server response bodies traced back to URL input
- Unexpected outbound requests from user browsers to attacker-controlled domains following visits to application URLs
Detection Strategies
- Review Undertow and Jastow configuration files for options that permit unescaped or non-standard characters in request URIs
- Inspect access logs for URL patterns containing encoded or raw HTML control characters such as %3C, %3E, <, and >
- Correlate reflected input in HTTP responses with the originating request parameters to identify injection sinks
Monitoring Recommendations
- Enable verbose request logging on Undertow listeners and forward logs to a centralized analytics platform
- Alert on anomalous URL character distributions and repeated requests containing scripting keywords
- Monitor Content Security Policy (CSP) violation reports for evidence of blocked injection attempts
How to Mitigate CVE-2025-12799
Immediate Actions Required
- Apply updates referenced in Red Hat advisories RHSA-2026:36342, RHSA-2026:36343, RHSA-2026:36344, and RHSA-2026:36345
- Audit application configuration to identify any option that allows unescaped characters in URLs and disable it where not strictly required
- Enforce a restrictive Content Security Policy that blocks inline script execution
Patch Information
Red Hat has released fixed packages through the errata listed above. Consult the Red Hat CVE Analysis for CVE-2025-12799 and Red Hat Bug Report #2413071 for the authoritative fixed version list and product mappings.
Workarounds
- Revert Undertow and Jastow to default URL character handling that rejects unescaped control characters
- Deploy a reverse proxy or web application firewall rule that blocks requests containing raw <, >, and quote characters in URL components
- Apply contextual output encoding at the application layer for any URL-derived content rendered into HTML responses
# Example WAF-style rule to drop requests with raw HTML control characters in the URI
# ModSecurity-compatible pseudo-rule
SecRule REQUEST_URI "@rx [<>\"']" \
"id:1012799,phase:1,deny,status:400,log,msg:'CVE-2025-12799 - blocked unescaped URL character'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
