CVE-2026-19611
Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
- Record
CVE-2026-19611- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-173
- Updated
- 2026-11-06
EUVDEUVD-2026-63478
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
- Record
EUVD-2026-63478- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-h79m-h3j4-r7qm
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with...
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
- Record
GHSA-h79m-h3j4-r7qm- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-173
- Updated
- 2026-11-06
NVD
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
- Record
CVE-2026-19611- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-173
- Updated
- 2026-11-06
Affected products
- red hat build of apache camel 3.33.3.sp2
- red hat build of apache camel 4 for quarkus 3
- red hat build of debezium 3
- red hat build of debezium 3.6
- red hat build of keycloak 26.4
- red hat build of keycloak 26.4.17
- red hat build of keycloak 26.6
- red hat build of keycloak 26.6.8
- red hat build of quarkus 3.27.5.sp2
- red hat build of quarkus 3.33.3.sp2
- red hat data grid 8
- red hat jboss enterprise application platform 7
History
| Recorded | Changed | Sources |
|---|---|---|
| products, references | CVE List | |
| products, references | EUVD, GitHub Advisories, NVD | |
| products, references | CVE List | |
| facts, products, references | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19611 is a high vulnerability (CVSS 7.4) in Red Hat Build Of Apache Camel 3.33.3.sp2, published August 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 64th percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:69440