{"id":"CVE-2026-12353","title":"Rhcs: memory leak during https connection leads to denial of service","summary":"An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to res…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-772"],"vendor":"Red Hat","product":"pki-core","affected":["pki-core (all versions)","dogtag-pki (all versions)","pki-core:10.6/pki-core (all versions)","pki-core (all versions)"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-07-24T22:05:10.429830Z"},"published":"2026-07-23","updated":"2026-11-05","sourceUpdated":"2026-11-05T17:02:33.760Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-12353","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12353"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489056","label":"RHBZ#2489056"}],"tags":["cve.org"],"epss":0.00437,"epssPercentile":0.38119,"ingestedAt":"2026-11-05T22:38:31.415Z","slug":"CVE-2026-12353","body":"## Overview\n\nAn unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.\n\n## Affected\n\n- `pki-core (all versions)`\n- `dogtag-pki (all versions)`\n- `pki-core:10.6/pki-core (all versions)`\n- `pki-core (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}