Bug 2484703 (CVE-2026-10832)

Summary:	CVE-2026-10832 org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abrianik, ant, anujha, aschwart, asoldano, aszczucz, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, cmah, dandread, dhanak, dkreling, dlofthou, drichtar, drosa, eaguilar, ebaron, fmongiar, ggrzybek, gmalinko, gsmet, ibek, istudens, ivassile, iweiss, janstey, jmartisk, jmatsuok, jnethert, jolong, jpechane, jraez, jrokos, jtolenti, lthon, manderse, mnovotny, mosmerov, mposolda, msvehla, nwallace, olubyans, ozzy, parichar, pberan, pdelbell, pesilva, pgallagh, pjindal, pmackay, probinso, rguimara, rmartinc, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, security-response-team, smaestri, ssilvert, sthorger, tasato, thjenkin, tqvarnst, varjain, vdosoudi, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-04 10:25:32 UTC

A resource exhaustion vulnerability exists in the DERDecoder class within org.wildfly.security:wildfly-elytron-asn1, where primitive type decoders (decodeOctetString(), decodeBitString(), decodeInteger(), etc.) allocate a byte[] array based on the declared length field of a DER-encoded input without validating it against the actual remaining bytes in the buffer.
An attacker can craft a minimal 7-byte DER payload with an inflated length value, causing the decoder to attempt a multi-gigabyte heap allocation that exhausts JVM memory and triggers an OutOfMemoryError.
This results in a remote denial-of-service condition against any service endpoint that processes untrusted DER/ASN.1 input through the affected decoder, including SASL authentication mechanisms and X.500 certificate principal parsing paths.
The root cause is the absence of a bounds check comparing the declared content length against the available data in the input stream prior to memory allocation.

Comment 2 Jon Orris 2026-09-22 12:56:31 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

Via RHSA-2026:70228 https://access.redhat.com/errata/RHSA-2026:70228

Comment 3 Jon Orris 2026-09-22 12:58:58 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10

Via RHSA-2026:70230 https://access.redhat.com/errata/RHSA-2026:70230

Comment 4 Jon Orris 2026-09-22 13:01:04 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

Via RHSA-2026:70229 https://access.redhat.com/errata/RHSA-2026:70229

Comment 5 Jon Orris 2026-09-22 15:36:06 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1

Via RHSA-2026:70277 https://access.redhat.com/errata/RHSA-2026:70277