Skip to content
fr Sign in
7.4 High

CVE-2026-19611 Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

Description

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Debezium 3 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Single Sign-On 7 Versions not published
Show the 7 other branches
Product Affected versions Fixed in
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2 Versions not published
Red Hat build of Quarkus 3.27.5.SP2 Versions not published
Red Hat build of Quarkus 3.33.3.SP2 Versions not published
Red Hat Build of Apache Camel 3.33.3.SP2 2.8 earliest → < 2.8.4.Final-redhat-00002 2.8.4.Final-redhat-00002
Red Hat Build of Debezium 3.6 Versions not published
Red Hat build of Keycloak 26.4 26.4 earliest → < 26.4-30 26.4-30
Red Hat build of Keycloak 26.6.8 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat build of Apache Camel 4 for Quarkus 3

The 75 CVEs of Red Hat build of Apache Camel 4 for Quarkus 3 →
CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 7.7 High CVE-2026-120971 A flaw was found in RESTEasy's default exception mapper 5.3 Medium CVE-2026-119542 A flaw was found in the Ickle query parser in Infinispan 4.3 Medium CVE-2026-94449 Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service 7.5 High
Track this CVE