CVE-2026-19611 Weak cryptography in Red Hat Build of Apache Camel 3.33.3.SP2
Attackers can guess passwords more easily because Unicode normalization collapses fullwidth characters to ASCII, reducing the effective password keyspace.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19611?
CVE-2026-19611 is a high-severity vulnerability in Red Hat Build of Apache Camel 3.33.3.SP2, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
Weakness: CWE-173
Which versions are affected by CVE-2026-19611?
How do I fix CVE-2026-19611?
No fix has been published for CVE-2026-19611 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-19611 being exploited?
There is no known exploitation of CVE-2026-19611 in the wild and no public exploit code.
Sources
Also known as GHSA-h79m-h3j4-r7qm.