CVE-2026-12353

MEDIUM

Rhcs: memory leak during https connection leads to denial of service

Title source: cna

Description

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.

References (2)

Core 2

Core References

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-12353

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2489056

https://bugzilla.redhat.com/show_bug.cgi?id=2489056

Scores

CVSS v3 5.3

EPSS 0.0026

EPSS Percentile 17.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-772

Status published

Products (4)

Red Hat/Red Hat Certificate System 9

Red Hat/Red Hat Enterprise Linux 10

Red Hat/Red Hat Enterprise Linux 8

Red Hat/Red Hat Enterprise Linux 9

Published Jul 23, 2026

Tracked Since Jul 24, 2026