What is the CVSS score of CVE-2026-12353?

CVE-2026-12353 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Red Hat Certificate System CVE-2026-12353

EUVD-2026-48375 MEDIUM

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-07-23 redhat

GHSA-q466-j42v-76wm

Denial Of Service Java Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Certificate System 9 Red Hat

5.3

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated attack with no complexity; availability is H because the Java process crash constitutes complete service loss, not partial degradation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:49 vuln.today

CVE Published

Jul 23, 2026 - 19:10 cve.org

MEDIUM 5.3

DescriptionCVE.org

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.

AnalysisAI

Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.

Technical ContextAI

Red Hat Certificate System is an enterprise PKI solution built on Java and deployed on Red Hat Enterprise Linux (RHEL 8, 9, and 10 per CPE cpe:2.3:a:red_hat:red_hat_certificate_system_9 and associated RHEL CPEs). The root cause is CWE-772 (Missing Release of Resource after Effective Lifetime): the Java process handling inbound TLS connections fails to properly release memory allocated per request, allowing an attacker to accumulate unreleased heap allocations across many successive connections. The Java Virtual Machine's garbage collector is unable to reclaim this memory fast enough under sustained request load, ultimately triggering an OutOfMemoryError that terminates the process. Because RHCS acts as a certificate authority - issuing, revoking, and managing X.509 certificates - its unavailability can cascade to dependent systems relying on OCSP, CRL distribution, or certificate enrollment workflows.

RemediationAI

No specific patched version number has been confirmed from the available references at time of analysis; consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12353 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2489056 for patch availability and errata details - apply any released update immediately once confirmed. As a compensating control, restrict network access to the RHCS TLS endpoint using firewall rules (firewalld or iptables) to permit connections only from trusted client IP ranges; this eliminates the unauthenticated remote attack surface entirely and is the most effective interim measure. Rate-limiting inbound connections to the TLS port via a reverse proxy or load balancer can reduce the feasibility of memory exhaustion without fully blocking access, though it does not eliminate the vulnerability and adds infrastructure complexity. Additionally, configure a watchdog or systemd service restart policy (e.g., Restart=on-failure in the RHCS service unit) to reduce recovery time after a crash, though this does not prevent the denial-of-service itself. Monitor JVM heap utilization via JMX or system metrics to detect an attack in progress before full OOM is reached.