Is CVE-2026-12353 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12353 being exploited in the wild.

How severe is CVE-2026-12353?

Medium severity, with a CVSS score of 5.3, published 23 July 2026.

Is there a fix for CVE-2026-12353?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12353 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-12353?

Check whether you run Dogtag PKI Project Dogtag PKI or Red Hat Certificate System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12353: Red Hat Certificate System memory leak in TLS endpoint

CVE-2026-12353 · Severity: medium · CVSS 5.3 · Published 2026-07-23

Red Hat Certificate System (RHCS) is a software framework used to manage digital certificates and secure communications. A vulnerability has been identified where an unauthenticated attacker can crash the system by sending a large volume of specific web requests. This results in a denial of service, potentially requiring manual intervention from administrators to restart the service and restore security operations.

Technologies: Dogtag PKI Project Dogtag PKI, Red Hat Certificate System. Vendors: Dogtag PKI Project, Red Hat.

Quick answers

Is CVE-2026-12353 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12353 being exploited in the wild.
How severe is CVE-2026-12353?: Medium severity, with a CVSS score of 5.3, published 23 July 2026.
Which products and versions are affected?: Red Hat Certificate System 9.
Is there a fix for CVE-2026-12353?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12353 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-12353?: Check whether you run Dogtag PKI Project Dogtag PKI or Red Hat Certificate System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as a resource leak (CWE-772) within the Java-based Red Hat Certificate System (RHCS). An unauthenticated remote attacker can exploit this by repeatedly sending HTTP requests to the TLS endpoint, which causes the application to fail to release memory resources. Over time, this leads to an Out of Memory (OOM) condition that crashes the Java process. The attack requires no special privileges or user interaction. Depending on the environment configuration, the service may not automatically recover, necessitating manual administrative intervention to restart the pki-core or dogtag-pki components.

Affected products

Red Hat Red Hat Certificate System 9 9
Red Hat Red Hat Enterprise Linux 10 dogtag-pki
Red Hat Red Hat Enterprise Linux 9 pki-core
Red Hat Red Hat Enterprise Linux 8 pki-core:10.6/pki-core

Timeline

2026-06-15: other: Reported to Red Hat Bugzilla
2026-07-23: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.