The vulnerability exists in the DERDecoder class within wildfly-elytron-asn1, where the decoder does not properly validate length values in DER payloads. An attacker can exploit this by sending a crafted DER payload with an inflated length, causing the decoder to allocate excessive memory and exhaust JVM resources. This results in a denial of service for applications processing untrusted DER/ASN.1 data, such as SASL authentication mechanisms and X.500 certificate principal parsing paths. Red Hat has classified this as a moderate vulnerability with a CVSS 3.1 base score of 5.9, reflecting a network attack vector with high attack complexity and no required privileges or user interaction. No patch or mitigation currently meets Red Hat's standards for deployment and stability.

Successful exploitation leads to a denial of service condition by exhausting Java Virtual Machine memory resources, disrupting availability of affected services that process untrusted DER/ASN.1 input. There is no impact on confidentiality or integrity. The attack can be performed remotely without authentication or user interaction, but requires high attack complexity.

As per the Red Hat advisory, no mitigation or patch currently meets the criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for future updates. No immediate workaround is available.