High severity · published Aug 20, 2026
CVE-2026-19611
Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
7.4
CVSS
0.9%
EPSS
No
On KEV
Description
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Build of Keycloak · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Data Grid 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Single Sign-On 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apache Camel 4 for Quarkus 3 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Debezium 3 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat Build of Apache Camel 3.33.3.SP2
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19611
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:69440
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:69470
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:70257
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:83612
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-19611
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2514568
More from Red Hat Build of Apache Camel 3.33.3.SP2
8.2
CVE-2026-93569
Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority
7.5
CVE-2026-93568
Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests
7.5
CVE-2026-93567
Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority
7.5
CVE-2026-93565
Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
7.5
CVE-2026-93564
Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)