VulnerabilityAwaiting Analysis

CVE-2026-12353

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint.

MEDIUM 5.3EPSS 0.44%

Does this matter?

Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own.

Description

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.44% probability · 37th percentile
CISA KEV: Not listed
Weakness: CWE-772
Source: secalert@redhat.com

References

https://access.redhat.com/security/cve/CVE-2026-12353
https://bugzilla.redhat.com/show_bug.cgi?id=2489056

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.