CVE-2026-10832: Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-18 · updated 2026-10-20
Weakness: CWE-770

Description

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.

Affected products

Red Hat build of Keycloak 26.4: all versions
Red Hat build of Quarkus: all versions
Red Hat Cryostat 4: all versions
Red Hat build of Apache Camel - HawtIO 4: all versions
Red Hat build of Apache Camel 4 for Quarkus 3: all versions
Red Hat build of Debezium 3: all versions
Red Hat Data Grid 8: all versions
Red Hat Fuse 7: all versions
Red Hat JBoss Enterprise Application Platform 8.1.8.GA: all versions — fixed in 2.6.11.Final-redhat-00001
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10: all versions — fixed in 0:1.1.9-1.redhat_00001.1.el10eap, 0:1.2.7-1.redhat_00002.1.el10eap, 0:1.85.0-1.redhat_00001.1.el10eap, 0:2.0.18-1.redhat_00001.1.el10eap, 0:2.0.5-1.Final_redhat_00001.1.el10eap, 0:2.1.0-1.redhat_00001.1.el10eap
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8: all versions — fixed in 0:1.1.9-1.redhat_00001.1.el8eap, 0:1.2.7-1.redhat_00002.1.el8eap, 0:1.85.0-1.redhat_00001.1.el8eap, 0:2.0.18-1.redhat_00001.1.el8eap, 0:2.0.5-1.Final_redhat_00001.1.el8eap, 0:2.1.0-1.redhat_00001.1.el8eap
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9: all versions — fixed in 0:1.1.9-1.redhat_00001.1.el9eap, 0:1.2.7-1.redhat_00002.1.el9eap, 0:1.85.0-1.redhat_00001.1.el9eap, 0:2.0.18-1.redhat_00001.1.el9eap, 0:2.0.5-1.Final_redhat_00001.1.el9eap, 0:2.1.0-1.redhat_00001.1.el9eap
Red Hat JBoss Enterprise Application Platform Expansion Pack: all versions
Red Hat Lightspeed for Runtimes Operator: all versions
Red Hat Process Automation 7: all versions
Red Hat Single Sign-On 7: all versions

How to fix

Upgrade to a fixed version: Red Hat JBoss Enterprise Application Platform 8.1.8.GA 2.6.11.Final-redhat-00001; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:1.1.9-1.redhat_00001.1.el10eap, 0:1.2.7-1.redhat_00002.1.el10eap, 0:1.85.0-1.redhat_00001.1.el10eap, 0:2.0.18-1.redhat_00001.1.el10eap; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:1.1.9-1.redhat_00001.1.el8eap, 0:1.2.7-1.redhat_00002.1.el8eap, 0:1.85.0-1.redhat_00001.1.el8eap, 0:2.0.18-1.redhat_00001.1.el8eap; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:1.1.9-1.redhat_00001.1.el9eap, 0:1.2.7-1.redhat_00002.1.el9eap, 0:1.85.0-1.redhat_00001.1.el9eap, 0:2.0.18-1.redhat_00001.1.el9eap. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-10832 or the next vulnerability affects your stack