CVE-2026-19611: falha de alta gravidade em Red Hat Build of Apache Camel 3.33.3.SP2
Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.4epss 0.9%
probabilidade de exploração
0.9%top 41% das CVEs
exploração observada
nãonenhuma fonte reporta
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Red Hat · Red Hat Build of Apache Camel 3.33.3.SP2Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3Red Hat · Red Hat build of Debezium 3Red Hat · Red Hat Build of Debezium 3.6Red Hat · Red Hat Build of KeycloakRed Hat · Red Hat build of Quarkus 3.27.5.SP2Red Hat · Red Hat build of Quarkus 3.33.3.SP2Red Hat · Red Hat Data Grid 8Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Single Sign-On 7CVEs relacionadas — Red Hat Build of Apache Camel 3.33.3.SP2
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.6%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.2%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2024-3884HIGHUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedEPSS 1.4%
Referências
https://access.redhat.com/errata/RHSA-2026:69440https://access.redhat.com/errata/RHSA-2026:69470https://access.redhat.com/errata/RHSA-2026:70257https://access.redhat.com/errata/RHSA-2026:83612https://access.redhat.com/security/cve/CVE-2026-19611https://bugzilla.redhat.com/show_bug.cgi?id=2514568