Vulnpedia
← All CVEs

CVE-2026-10832

MEDIUM 5.9 ALL-YEARS

Published 2026-09-18 · Last modified 2026-10-08 · redhat · NVD: Awaiting Analysis

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.

LIMITED SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 35th percentile

○ In CISA KEV○ Public exploit / PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

5.9CVSS 3.1 · MEDIUM · CNA

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.

Affected

Vendors Red Hat

Products Red Hat Jboss Enterprise Application Platform 8.1 Red Hat Jboss Enterprise Application Platform 8.1 For Rhel 10 Red Hat Jboss Enterprise Application Platform 8.1 For Rhel 8 Red Hat Jboss Enterprise Application Platform 8.1 For Rhel 9 Cryostat 4 Red Hat Build Of Apache Camel 4 For Quarkus 3 Red Hat Build Of Apache Camel Hawtio 4 Red Hat Build Of Debezium 3 Red Hat Build Of Keycloak Red Hat Build Of Quarkus Red Hat Data Grid 8 Red Hat Fuse 7 Red Hat Jboss Enterprise Application Platform 7 Red Hat Jboss Enterprise Application Platform Expansion Pack Red Hat Lightspeed For Runtimes Operator Red Hat Process Automation 7 Red Hat Single Sign On 7

Weakness (CWE)

  • CWE-770: Allocation of Resources Without Limits or Throttling

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

All CVSS metrics

  • MEDIUM 5.9 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • MEDIUM 5.9 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS