CVE-2026-10832
Description
A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jboss_enterprise_application_platform 8.1 | No range specified | — |
| Red Hat Cryostat 4 | No range specified | — |
| Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 | No range specified | — |
| Red Hat Red Hat build of Apache Camel - HawtIO 4 | No range specified | — |
| Red Hat Red Hat build of Debezium 3 | No range specified | — |
| Red Hat Red Hat Build of Keycloak | No range specified | — |
| Red Hat Red Hat build of Quarkus | No range specified | — |
| Red Hat Red Hat Data Grid 8 | No range specified | — |
| Red Hat Red Hat Fuse 7 | No range specified | — |
| Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack | No range specified | — |
| Red Hat Red Hat Lightspeed for Runtimes Operator | No range specified | — |
| Red Hat Red Hat Process Automation 7 | No range specified | — |
| Red Hat Red Hat Single Sign-On 7 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.