5.3 Medium

CVE-2026-12353 Rhcs: memory leak during https connection leads to denial of service

Description

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Certificate System 9	Versions not published
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 8	Versions not published
Red Hat Enterprise Linux 9	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2489056 bugzilla.redhat.com

Timeline

Published July 23, 2026
Last modified November 5, 2026

The 9 CVEs of Red Hat Certificate System 9 →

CVE-2026-104988 Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject 8.1 High CVE-2026-80110 Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint 8.1 High CVE-2026-76561 Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint) 7.2 High CVE-2026-53682 Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts 5.3 Medium

Track this CVE