---
id: CVE-2026-12353
title: 'Rhcs: memory leak during https connection leads to denial of service'
summary: >-
  An unauthenticated attacker could trigger an Out of Memory condition to crash
  the Java process for RHCS by repeatedly sending HTTP requests to the TLS
  endpoint. Depending on how the RHCS server is configured, a manual
  intervention to res…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-772
vendor: Red Hat
product: pki-core
affected:
  - pki-core (all versions)
  - dogtag-pki (all versions)
  - 'pki-core:10.6/pki-core (all versions)'
  - pki-core (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-24T22:05:10.429830Z'
published: '2026-07-23'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T17:02:33.760Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-12353'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-12353'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2489056'
    label: RHBZ#2489056
tags:
  - cve.org
epss: 0.00437
epssPercentile: 0.38119
ingestedAt: '2026-11-05T22:38:31.415Z'
---

## Overview

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.

## Affected

- `pki-core (all versions)`
- `dogtag-pki (all versions)`
- `pki-core:10.6/pki-core (all versions)`
- `pki-core (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.