Red Hat Lightspeed For Runtimes Operator
Monthly
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.