PT-2026-64150 · Red Hat · Red Hat Certificate System 9+3

Thibault Guittet · CVE-2026-12353 · Published 2026-07-23 · Updated 2026-07-23

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2026-12353

Affected Products

Red Hat Certificate System 9

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-12353 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2489056 · Note
• https://access.redhat.com/security/cve/CVE-2026-12353 · Note