Medium severity · published Jul 23, 2026
CVE-2026-12353
Rhcs: memory leak during https connection leads to denial of service
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Certificate System 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12353
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-12353
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2489056
More from Red Hat Certificate System 9
7.2
CVE-2026-76561
Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)
6.5
CVE-2026-11873
Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure
6.5
CVE-2026-18047
Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash
5.8
CVE-2026-18369
Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
5.3
CVE-2026-53682
Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts