CVE-2026-10832

CVE CVE-2026-10832EUVD EUVD-2026-82936Published 2026-09-18T14:19:29.000ZLast changed 2026-09-22T15:41:48.000ZCVSS 5.9

What the advisory describes

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Red Hat — Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 patch: 0:3.2.2-1.redhat_00001.1.el10eap; patch: 0:2.3.2-1.redhat_00001.1.el10eap; patch: 0:8.1.1-12.GA_redhat_00048.1.el10eap; patch: 0:6.6.54-1.Final_redhat_00001.1.el10eap; patch: 0:3.0.22-1.Final_redhat_00001.1.el10eap; patch: 0:4.0.5-1.redhat_00001.1.el10eap; patch: 0:1.2.7-1.redhat_00002.1.el10eap; patch: 0:3.0.1-1.Final_redhat_00001.1.el10eap; patch: 0:1.85.0-1.redhat_00001.1.el10eap; patch: 0:5.1.0-1.Final_redhat_00001.1.el10eap; patch: 0:9.37.4-1.redhat_00001.1.el10eap; patch: 0:801.8.0-1.GA_redhat_00001.1.el10eap; patch: 0:2.2.0-1.Final_redhat_00001.1.el10eap; patch: 0:4.1.136-1.Final_redhat_00001.1.el10eap; patch: 0:2.0.5-1.Final_redhat_00001.1.el10eap; patch: 0:4.0.7-4.redhat_00001.1.el10eap; patch: 0:7.4.0-1.Final_redhat_00001.1.el10eap; patch: 0:4.0.11-2.SP1_redhat_00001.1.el10eap; patch: 0:1.1.9-1.redhat_00001.1.el10eap; patch: 0:3.1.0-1.Final_redhat_00001.1.el10eap; patch: 0:2.3.26-2.SP3_redhat_00001.1.el10eap; patch: 0:2.25.4-1.redhat_00003.1.el10eap; patch: 0:2.40.0-8.redhat_00024.1.el10eap; patch: 0:3.0.6-1.redhat_00001.1.el10eap; patch: 0:2.6.11-1.Final_redhat_00001.1.el10eap; patch: 0:4.1.5-5.redhat_00008.1.el10eap; patch: 0:8.1.8-9.GA_redhat_00006.1.el10eap; patch: 0:5.0.31-1.SP2_redhat_00001.1.el10eap; patch: 0:2.1.0-1.redhat_00001.1.el10eap; patch: 0:4.1.7-1.SP1_redhat_00001.1.el10eap; patch: 0:3.6.3-1.Final_redhat_00001.1.el10eap; patch: 0:2.18.9-1.redhat_00003.1.el10eap; patch: 0:2.0.18-1.redhat_00001.1.el10eap
• Red Hat — Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 patch: 0:2.0.18-1.redhat_00001.1.el8eap; patch: 0:3.0.22-1.Final_redhat_00001.1.el8eap; patch: 0:801.8.0-1.GA_redhat_00001.1.el8eap; patch: 0:4.1.7-1.SP1_redhat_00001.1.el8eap; patch: 0:2.18.9-1.redhat_00003.1.el8eap; patch: 0:8.1.8-9.GA_redhat_00006.1.el8eap; patch: 0:8.1.1-12.GA_redhat_00048.1.el8eap; patch: 0:2.0.5-1.Final_redhat_00001.1.el8eap; patch: 0:3.2.2-1.redhat_00001.1.el8eap; patch: 0:4.1.5-5.redhat_00008.1.el8eap; patch: 0:2.3.2-1.redhat_00001.1.el8eap; patch: 0:5.0.31-1.SP2_redhat_00001.1.el8eap; patch: 0:5.1.0-1.Final_redhat_00001.1.el8eap; patch: 0:3.1.0-1.Final_redhat_00001.1.el8eap; patch: 0:3.6.3-1.Final_redhat_00001.1.el8eap; patch: 0:2.25.4-1.redhat_00003.1.el8eap; patch: 0:1.85.0-1.redhat_00001.1.el8eap; patch: 0:4.0.11-2.SP1_redhat_00001.1.el8eap; patch: 0:1.2.7-1.redhat_00002.1.el8eap; patch: 0:1.1.9-1.redhat_00001.1.el8eap; patch: 0:4.0.7-4.redhat_00001.1.el8eap; patch: 0:2.2.0-1.Final_redhat_00001.1.el8eap; patch: 0:7.4.0-1.Final_redhat_00001.1.el8eap; patch: 0:6.6.54-1.Final_redhat_00001.1.el8eap; patch: 0:4.0.5-1.redhat_00001.1.el8eap; patch: 0:2.40.0-8.redhat_00024.1.el8eap; patch: 0:3.0.6-1.redhat_00001.1.el8eap; patch: 0:9.37.4-1.redhat_00001.1.el8eap; patch: 0:2.3.26-2.SP3_redhat_00001.1.el8eap; patch: 0:2.6.11-1.Final_redhat_00001.1.el8eap; patch: 0:3.0.1-1.Final_redhat_00001.1.el8eap; patch: 0:2.1.0-1.redhat_00001.1.el8eap; patch: 0:4.1.136-1.Final_redhat_00001.1.el8eap
• Red Hat — Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 patch: 0:8.1.8-9.GA_redhat_00006.1.el9eap; patch: 0:2.1.0-1.redhat_00001.1.el9eap; patch: 0:2.3.2-1.redhat_00001.1.el9eap; patch: 0:2.25.4-1.redhat_00003.1.el9eap; patch: 0:3.0.6-1.redhat_00001.1.el9eap; patch: 0:2.6.11-1.Final_redhat_00001.1.el9eap; patch: 0:2.18.9-1.redhat_00003.1.el9eap; patch: 0:801.8.0-1.GA_redhat_00001.1.el9eap; patch: 0:4.0.5-1.redhat_00001.1.el9eap; patch: 0:4.0.7-4.redhat_00001.1.el9eap; patch: 0:2.3.26-2.SP3_redhat_00001.1.el9eap; patch: 0:4.1.7-1.SP1_redhat_00001.1.el9eap; patch: 0:1.85.0-1.redhat_00001.1.el9eap; patch: 0:2.0.5-1.Final_redhat_00001.1.el9eap; patch: 0:8.1.1-12.GA_redhat_00048.1.el9eap; patch: 0:3.6.3-1.Final_redhat_00001.1.el9eap; patch: 0:2.2.0-1.Final_redhat_00001.1.el9eap; patch: 0:1.1.9-1.redhat_00001.1.el9eap; patch: 0:3.1.0-1.Final_redhat_00001.1.el9eap; patch: 0:5.0.31-1.SP2_redhat_00001.1.el9eap; patch: 0:1.2.7-1.redhat_00002.1.el9eap; patch: 0:5.1.0-1.Final_redhat_00001.1.el9eap; patch: 0:3.0.1-1.Final_redhat_00001.1el9eap; patch: 0:6.6.54-1.Final_redhat_00001.1.el9eap; patch: 0:3.2.2-1.redhat_00001.1.el9eap; patch: 0:3.0.22-1.Final_redhat_00001.1.el9eap; patch: 0:2.0.18-1.redhat_00001.1.el9eap; patch: 0:4.1.5-5.redhat_00008.1.el9eap; patch: 0:4.0.11-2.SP1_redhat_00001.1.el9eap; patch: 0:7.4.0-1.Final_redhat_00001.1.el9eap; patch: 0:9.37.4-1.redhat_00001.1.el9eap; patch: 0:4.1.136-1.Final_redhat_00001.1.el9eap; patch: 0:2.40.0-8.redhat_00024.1.el9eap

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Red Hat — Red Hat JBoss Enterprise Application Platform

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.