Security readout for executives and security teams
Plain-English summary
A flaw in Jastow, the JSP engine used with Undertow inside Red Hat JBoss EAP 8.1, can let an attacker slip malicious characters through a URL when the server is configured to accept unescaped input. The result can be a cross-site scripting condition that runs attacker content in a user's browser. Red Hat rates the issue medium; no active exploitation has been reported.
Executive priority
Schedule as a standard patch cycle item for teams running JBoss EAP 8.1 on RHEL 10. Not a fire drill: no KEV entry, high attack complexity, and a specific configuration is needed. Prioritize internet-facing EAP workloads first and coordinate with app owners to confirm URL-handling settings.
Technical view
Per Red Hat's advisory, Jastow fails to properly sanitize URI input when combined with Undertow under a configuration that permits unescaped characters in URLs. This CWE-79 weakness can allow reflected XSS payloads to be embedded in responses processed by the JSP engine. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N (6.5) reflects network reach with elevated attack complexity and no required privileges.
Likely exposure
Red Hat lists JBoss EAP 8.1 for RHEL 10 packages (eap8, eap8-activemq-artemis, and related components) as affected. EAP 8.1 on RHEL 9 is marked unaffected. Exposure depends on whether the deployment enables the non-default configuration that permits unescaped characters in URLs alongside embedded Undertow and Jastow.
Exploitation context
No KEV listing and no public reports of in-the-wild exploitation are cited. Attack complexity is high per CVSS, and exploitation requires a specific permissive URL-handling configuration. No user interaction is required, but the scope is unchanged and availability is not impacted.
Researcher notes
Root cause is improper input handling of URI characters in Jastow when combined with Undertow's permissive URL parsing. Impact is C:L/I:H, consistent with reflected XSS that can alter rendered content or hijack session context. Trigger conditions are configuration-dependent, so exploitability varies. See RHBZ#2413071 and the four RHSAs for the exact fixed builds and any operator workarounds.
Mitigation direction
- Apply the fixed EAP 8.1 for RHEL 10 packages referenced in RHSA-2026:36342 through 36345.
- Review Undertow/Jastow settings and disallow unescaped characters in URL handling unless required.
- Consult Red Hat's CVE-2025-12799 advisory for authoritative remediation and workarounds.
- Add WAF rules that filter script-like payloads in URI paths and query strings.
- Track EAP 8.1 RHEL 9 systems as unaffected per Red Hat but confirm inventory.
Validation and detection
- Inventory JBoss EAP 8.1 hosts and identify RHEL 10 versus RHEL 9 platforms.
- Compare installed eap8-* package versions against the fixed builds in the RHSAs.
- Audit standalone.xml/undertow subsystem for options that allow unescaped URL characters.
- Review web access logs for anomalous URI-encoded script patterns targeting JSP endpoints.
- Confirm patched hosts through Red Hat Satellite or subscription-manager after update.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-12799 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N2.24.2redhatVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:36342CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:36343CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:36344CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:36345CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-12799CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2413071CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.