-
Task
-
Resolution: Done
-
Blocker
-
None
-
None
The integration test HeaderEmptyHostTest (originally introduced via RESTEASY-2300 / PR #2435) is failing on WildFly 39+. This failure is expected behavior following the fix for CVE-2025-12543 in Undertow, which now strictly rejects empty Host headers with a 400 Bad Request.
Justification for Removal
Upon review of the original PR this test was primarily intended to verify that the resteasy-netty4 utility class NettyUtil correctly handled empty host headers. However, there are several reasons why this test is no longer appropriate as an integration or unit test in RESTEasy Core:
- Connector Responsibility: RFC 9112 compliance regarding the Host header is the responsibility of the underlying HTTP connector (Undertow, Netty, Jetty, etc.). As a JAX-RS implementation, RESTEasy sits above this layer. If the platform (WildFly) has made a security-driven decision to be more restrictive than the RFC, the framework should respect the container's boundary.
- Redundancy in Mock Environment: Attempting to move this to a unit test using MockDispatcher provides no functional value. Such a test would only verify that RESTEasy's mock objects can store an empty string in a Map, rather than testing any meaningful request-processing logic or URI reconstruction.
- Security Posture: Maintaining a test that asserts the validity of an empty Host header creates a conflict with modern security baselines (SSRF and Request Smuggling prevention) adopted by the primary runtimes supported by RESTEasy.
Conclusion
Since the original regression (a potential NPE in Netty utility code) has long been resolved and the test now conflicts with intentional security hardening in the target container, the test is being removed to maintain a green build and reflect the security requirements of WildFly 39+.
- is related to
-
RESTEASY-2300 Blank Host Name still throws exception
-
- Resolved
-
- is triggered by
-
UNDERTOW-2656 CVE-2025-12543 Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
-
- Resolved
-