CVE-2026-12353 Rhcs: memory leak during https connection leads to denial of service
An unauthenticated attacker can crash the RHCS Java process by repeatedly sending HTTP requests to the TLS endpoint, causing a memory leak.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12353?
CVE-2026-12353 is a medium-severity denial of service vulnerability in Red Hat Certificate System 9, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.
Weakness: CWE-772
Which versions are affected by CVE-2026-12353?
How do I fix CVE-2026-12353?
No fix has been published for CVE-2026-12353 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-12353 being exploited?
There is no known exploitation of CVE-2026-12353 in the wild and no public exploit code.
Sources
Also known as GHSA-q466-j42v-76wm.