Red Hat Certificate System CVE-2026-12353

No authentication is required; the CVSS vector confirms PR:N (unauthenticated) and AV:N (network-accessible). The attacker must have network connectivity to the RHCS TLS HTTP endpoint - exploitation is limited to hosts that can reach this port, which in typical enterprise deployments means the internal network or a VPN-connected host rather than the open internet. No specific RHCS feature needs to be enabled beyond the default TLS listener. Exploitation is bounded by the degree of memory exhaustion required before OOM is triggered, which may vary with JVM heap configuration (-Xmx settings) - larger heap allocations increase the time and request volume needed to crash the process but do not prevent the attack. Manual intervention to restart the Java process may be required after a crash depending on service management configuration.

The vendor-assigned CVSS 3.1 score of 5.3 (Medium) reflects a network-reachable, no-authentication, low-complexity attack (AV:N/AC:L/PR:N/UI:N) with partial availability impact (A:L). However, A:L appears to understate the actual impact: crashing the Java process constitutes complete service unavailability for the certificate system until a manual or automated restart is performed - behavior more consistent with A:H. No EPSS data was provided, and no CISA KEV listing or public exploit code has been identified, suggesting this has not been actively exploited in broad campaigns at time of analysis. Despite the moderate CVSS score, the operational risk to environments relying on RHCS for active PKI functions is elevated: a downed certificate authority can disrupt authentication, TLS certificate issuance, and revocation checking across the enterprise. The attack is fully automatable with no special tooling - any HTTP flooding tool targeting the TLS port suffices. The primary limiting factor is that RHCS deployments are typically not internet-facing, which substantially reduces attacker access in most realistic environments.

An attacker with network access to the RHCS TLS endpoint uses a high-rate HTTP request flood - requiring no credentials or special tooling - to continuously allocate memory in the Java process without triggering adequate garbage collection. After sustaining the flood for a period sufficient to exhaust available heap, the JVM raises an OutOfMemoryError and the RHCS process terminates, rendering the certificate authority unavailable until an operator manually restarts the service.