wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in JSoup, Elytron, Reactor, BouncyCastle and zstd-jni Vulnerability Details CVEID:CVE-2026-75140 DESCRIPTION: jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in...

wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-10832

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

io.github.martinhickson:picketlink-idm-admin (>=3.0.8, <=5.2.6), org.eclipse.jetty.documentation:code-examples (>=10.0.25, <=11.0.26) +13 more potentially affected by CVE-2026-85511 via org.wildfly.security:wildfly-elytron (>=2.6.0.final, <=2.6.5.final)

org.wildfly.security:wildfly-elytron MAVEN version =2.6.0.final, =3.0.8, =10.0.25, =10.0.25, =10.0.25, =10.0.25, =10.0.25, =10.0.25, =26.2.0, =26.2.0, =26.2.0, =1.0.0.alpha3, =1.0.0.alpha3, =1.0.0.alpha3, =34.0.0.beta1, =37.0.1.final Source cves: CVE-2026-85511 Source advisory: MEND:CVE-2026-8551...

io.quarkus:quarkus-elytron-security-oauth2 (>=3.32.0.cr1, <=3.35.4), io.quarkus:quarkus-elytron-security-oauth2-deployment (>=3.32.0.cr1, <=3.35.4) +19 more potentially affected by CVE-2026-85511 via org.wildfly.security:wildfly-elytron-realm-token (>=2.8.0.final, <=2.8.5.final)

org.wildfly.security:wildfly-elytron-realm-token MAVEN version =2.8.0.final, =3.32.0.cr1, =3.32.0.cr1, =16.2.0.dev01, =16.2.0.dev01, =16.2.0.dev01, =16.2.0.dev01, =16.2.0.dev01, =26.6.0, =26.6.0, =26.6.0, =31.0.2.final, =31.0.2.final, =31.0.2.final, =31.0.2.final, =4.2.0.cr1, =4.2.1.final and mor...

io.github.martinhickson:picketlink-idm-admin (>=3.0.8, <=5.2.6), io.quarkus:quarkus-elytron-security-oauth2 (>=3.16.0.cr1, <=3.28.5) +53 more potentially affected by CVE-2026-85511 via org.wildfly.security:wildfly-elytron-realm-token (>=2.6.0.final, <=2.6.10.sp1)

org.wildfly.security:wildfly-elytron-realm-token MAVEN version =2.6.0.final, =3.0.8, =3.16.0.cr1, =3.16.0.cr1, =10.0.25, =10.0.25, =10.0.25, =10.0.25, =10.0.25, =10.0.25, =15.0.14.final, =15.0.9.final, =15.0.9.final, =14.0.32.final, =14.0.32.final, =14.0.32.final, =16.0.0.dev04 and more Source...

org.keycloak:keycloak-crypto-elytron (>=26.8.0, <=26.8.1), org.keycloak:keycloak-saml-wildfly-elytron-adapter (>=26.8.0, <=26.8.1) +1 more potentially affected by CVE-2026-85511 via org.wildfly.security:wildfly-elytron (2.9.2.sp1)

org.wildfly.security:wildfly-elytron MAVEN version 2.9.2.sp1 is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.security:wildfly-elytron and may be impacted: - org.keycloak:keycloak-crypto-elytron =26.8.0, =26.8.0, =26.8.0, =26.8.1 Source cves...

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...