CVE-2026-12353: Rhcs: memory leak during https connection leads to denial of service

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-23 · updated 2026-07-24
Weakness: CWE-772

Description

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.

Affected products

Red Hat Certificate System 9: all versions
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions

References

https://access.redhat.com/security/cve/CVE-2026-12353
https://bugzilla.redhat.com/show_bug.cgi?id=2489056

Get alerted when CVE-2026-12353 or the next vulnerability affects your stack