High [CVE-2026-45112] Denial of Service due to uncontrolled resource allocation
This high-severity Red Hat Linux advisory covers CVE-2026-45112 affecting Cryostat 4 on RHEL 9, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat Hardened Images.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Red Hat Linux publishes the next one.
VulniPulse checks Red Hat Linux's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources.
The flaw occurs when the application fails to properly limit or throttle resource allocation, leading to potential system instability or unresponsiveness. This vulnerability is rated as Important.
It stems from uncontrolled resource allocation in Apache Thrift Java bindings, which can lead to a denial of service.
This impacts Red Hat products such as Red Hat OpenShift AI, Red Hat build of Apache Camel, Red Hat Ceph Storage, Red Hat Connectivity Link, and Cryostat, where services utilizing these vulnerable bindings could experience resource exhaustion and service disruption. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-770.
Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Build of Apache Camel 4.18 for Quarkus 3.33; Red Hat Hardened Images; Red Hat OpenShift AI 2.25; and 7 more.
- < 0.19.0
- < 0.24.0
Official advisory · high-confidence parse· fetched 27 days ago·verify at source
- 0.24.0
- cryostat/cryostat-storage-rhel9:4.2.0-22
- libthrift
- thrift-main-0.24.0-0.1.hum1
- rhoai/odh-modelmesh-rhel9:1788319539
- RHSA-2026:68333
- RHSA-2026:54776
- RHSA-2026:49837
- RHSA-2026:65126
Official advisory · high-confidence parse· fetched 27 days ago·verify at source
Mitigation checklist
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Official advisory · high-confidence parse· fetched 27 days ago·verify at source
More Red Hat Linux advisories
- CVE-2026-42271May 8, 2026Authenticated command execution via MCP stdio test endpoints
- CVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-free
- CVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
- CVE-2026-97229Oct 13, 2026integer overflow issue in CI/CD regular expression compiler
- CVE-2026-64849Aug 17, 2026Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.