CVE-2026-19611: Improper Handling of Alternate Encoding in Red Hat Red Hat build of Apache Camel 4 for Quarkus 3

The vulnerability arises from WildFly Elytron's password hashing and verification process that normalizes input with Unicode NFKC. This normalization collapses fullwidth and other NFKC-compatible characters into ASCII equivalents, effectively reducing the complexity of passwords that use such characters. As a result, attackers can use ASCII-only dictionaries to guess passwords that were intended to be more complex, increasing the risk of unauthorized access. The issue affects Red Hat products shipping org.wildfly.security:wildfly-elytron-password-impl, including the Red Hat build of Apache Camel 4 for Quarkus 3. The vulnerability has a CVSS v3.1 score of 7.4 (high severity) with network attack vector, high attack complexity, no privileges required, and no user interaction needed. Red Hat states the impact is moderate and that successful exploitation depends on the use of fullwidth or NFKC-compatibility characters in passwords and the feasibility of guessing the password hashes deployed.

The vulnerability can lead to unauthorized access by allowing attackers to more easily guess passwords that include fullwidth or other NFKC-compatibility characters. This reduces password complexity and weakens authentication security. The impact is rated as moderate by Red Hat, with high confidentiality and integrity impact but no availability impact. Exploitation requires network access and has high attack complexity.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Since no patch or workaround is available, mitigation options are limited. Avoid using fullwidth or NFKC-compatibility characters in passwords where possible to reduce risk until a fix is released.