RHSA-2026:95759
Vulnerability from csaf_redhat - Published: 2026-11-06 10:21 - Updated: 2026-11-06 17:36Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.4.17 Security Update
Severity
Important
Notes
Topic: New Red Hat build of Keycloak 26.4.17 packages are available from the Customer Portal
Details: Red Hat build of Keycloak 26.4.17 is a standalone server, based on
the Keycloak project, that provides authentication and
standards-based single sign-on capabilities for web and mobile
applications.
Security fixes:
* Account takeover via authentication race using reset-credentials path (CVE-2026-103112)
* Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602)
* PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879)
* Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931)
* UMA Protection API resourceType field not validated — cross-owner resource access (CVE-2026-114232)
* Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)
* Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506)
* SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217)
* Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611)
* Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)
* Information disclosure via CORS Vary header overwrite (CVE-2026-59903)
* SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)
* SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874)
* Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965)
* Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763)
* SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855)
* DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857)
* Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488)
* Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491)
* HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492)
* Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558)
* Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562)
* HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564)
* Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565)
* HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566)
* HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567)
* HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568)
* HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569)
* Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573)
* HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574)
* HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579)
* SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998)
* kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453)
* DCR registration-time claim-path gap allows forging realm_access.roles (CVE-2026-96547)
* Unverified IdP email auto-linking enables account takeover (CVE-2026-97175)
* DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367)
* Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847)
* Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Bouncy Castle for Java, a cryptographic library. An attacker can exploit this vulnerability by manipulating rfc822Name and URI fields within X.509 certificates using a trailing dot. This bypasses Name Constraints, potentially leading to spoofing or unauthorized access. Such an exploit impacts the integrity and confidentiality of communications.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Keycloak 26.4.17
Red Hat / Red Hat build of Keycloak
|
cpe:/a:redhat:build_keycloak:26.4::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability related to how the software processes lazy ASN.1 sequences, which can reset an internal nesting-depth guard. This issue could lead to a Denial of Service (DoS), making the affected system or application unavailable.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account.
CWE-20 - Improper Input ValidationAffected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. The `CorsHandler` component incorrectly replaces application `Vary` headers, such as `Authorization` or `Cookie`, with `Origin`. This allows a caching proxy or Content Delivery Network (CDN) to reuse authenticated responses across different users, leading to the disclosure of sensitive information.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.
8.6 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
8.0 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.
6.4 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) [CVE-2026-110879]
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8763
Threats
Impact
Important
References
171 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New Red Hat build of Keycloak 26.4.17 packages are available from the Customer Portal",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Keycloak 26.4.17 is a standalone server, based on\nthe Keycloak project, that provides authentication and\nstandards-based single sign-on capabilities for web and mobile\napplications.\n\nSecurity fixes:\n* Account takeover via authentication race using reset-credentials path (CVE-2026-103112)\n* Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602)\n* PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879)\n* Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931)\n* UMA Protection API resourceType field not validated \u2014 cross-owner resource access (CVE-2026-114232)\n* Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)\n* Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506)\n* SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217)\n* Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611)\n* Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)\n* Information disclosure via CORS Vary header overwrite (CVE-2026-59903)\n* SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)\n* SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874)\n* Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965)\n* Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763)\n* SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855)\n* DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857)\n* Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488)\n* Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491)\n* HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492)\n* Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558)\n* Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562)\n* HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564)\n* Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565)\n* HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566)\n* HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567)\n* HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568)\n* HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569)\n* Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573)\n* HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574)\n* HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579)\n* SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998)\n* kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453)\n* DCR registration-time claim-path gap allows forging realm_access.roles (CVE-2026-96547)\n* Unverified IdP email auto-linking enables account takeover (CVE-2026-97175)\n* DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367)\n* Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847)\n* Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:95759",
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95759.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.4.17 Security Update",
"tracking": {
"current_release_date": "2026-11-06T17:36:08+00:00",
"generator": {
"date": "2026-11-06T17:36:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:95759",
"initial_release_date": "2026-11-06T10:21:22+00:00",
"revision_history": [
{
"date": "2026-11-06T10:21:22+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-06T10:21:22+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T17:36:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Keycloak 26.4.17",
"product": {
"name": "Red Hat build of Keycloak 26.4.17",
"product_id": "Red Hat build of Keycloak 26.4.17",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:build_keycloak:26.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Keycloak"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-8763",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-03T02:01:23.973629+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510198"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java, a cryptographic library. An attacker can exploit this vulnerability by manipulating rfc822Name and URI fields within X.509 certificates using a trailing dot. This bypasses Name Constraints, potentially leading to spoofing or unauthorized access. Such an exploit impacts the integrity and confidentiality of communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Bouncy Castle for Java, a cryptographic library used across various Red Hat products. The vulnerability allows an attacker to bypass Name Constraints in X.509 certificates by manipulating rfc822Name and URI fields with a trailing dot. This bypass could lead to spoofing or unauthorized access, impacting the integrity and confidentiality of communications in affected Red Hat environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8763"
},
{
"category": "external",
"summary": "RHBZ#2510198",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510198"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8763",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8763"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558",
"url": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-8763",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-8763"
}
],
"release_date": "2026-08-03T00:36:05.088000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI"
},
{
"cve": "CVE-2026-12860",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-08-03T04:01:02.591427+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A signature verification flaw was found in Bouncy Castle for Java\u0027s RSA PKCS#1 parser (`bcprov`). When verifying RSA PKCS#1 v1.5 signatures utilizing a NULL-omitted DigestInfo path, the verification routine incorrectly skips the last two bytes of the expected digest hash. An unauthenticated remote attacker can exploit this truncated comparison to craft forged signatures that pass verification, bypassing cryptographic integrity controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12860"
},
{
"category": "external",
"summary": "RHBZ#2510256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396",
"url": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860"
}
],
"release_date": "2026-08-03T02:55:58.379000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Enforce strict DigestInfo encoding checks requiring explicit ASN.1 NULL parameters in RSA PKCS#1 v1.5 signature verification, or mandate the use of RSA-PSS signature schemes in application TLS/crypto configuration.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification"
},
{
"cve": "CVE-2026-13506",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-03T04:01:05.710651+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510257"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability related to how the software processes lazy ASN.1 sequences, which can reset an internal nesting-depth guard. This issue could lead to a Denial of Service (DoS), making the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Bouncy Castle for Java can lead to a denial of service. A remote attacker could exploit a vulnerability in how lazy ASN.1 sequences are processed, allowing the resetting of an internal nesting-depth guard. This could result in resource exhaustion and make affected applications unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13506"
},
{
"category": "external",
"summary": "RHBZ#2510257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13506",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13506"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13506",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13506"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84",
"url": "https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-13506",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"
}
],
"release_date": "2026-08-03T02:56:49.476000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-18217",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-07-28T12:03:23+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2508311"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker\u0027s parameters. This can cause some service providers to process the attacker\u0027s data instead of the real login information, potentially leading to a user being logged into the wrong account.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific client configuration (wildcard redirect URIs) and a downstream service provider that incorrectly handles duplicate HTTP parameters. Successful exploitation allows an attacker to perform login CSRF or session swapping on the affected service provider. The vulnerability\u0027s root cause is the improper handling of the query string in the SAML HTTP-Redirect binding response, which fails to strip or validate pre-existing SAML parameters.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18217"
},
{
"category": "external",
"summary": "RHBZ#2508311",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508311"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18217"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18217",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18217"
}
],
"release_date": "2026-07-28T12:03:23+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution"
},
{
"acknowledgments": [
{
"names": [
"LiuBo-keep (aidan)"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-19611",
"cwe": {
"id": "CWE-173",
"name": "Improper Handling of Alternate Encoding"
},
"discovery_date": "2026-07-24T14:34:50+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514568"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue has Moderate impact. Successful exploitation depends on accounts using fullwidth or other NFKC-compatibility characters in passwords and on the feasibility of password guessing against the deployed hash algorithm. Red Hat products that ship org.wildfly.security:wildfly-elytron-password-impl may be affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19611"
},
{
"category": "external",
"summary": "RHBZ#2514568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514568"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19611",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19611"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611"
}
],
"release_date": "2026-07-24T14:34:50+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding"
},
{
"cve": "CVE-2026-58059",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-08-03T03:02:32.846217+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510250"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An algorithmic complexity vulnerability was found in Bouncy Castle for Java. The library performs quadratic-time escaping while stringifying X.500 distinguished names. An unauthenticated remote attacker can exploit this by passing a specially crafted X.500 distinguished name\u2014such as within an X.509 certificate during TLS handshakes or PKI parsing operations\u2014forcing high CPU resource consumption. This execution causes processing delays and leads to Denial of Service (DoS) for applications parsing untrusted distinguished names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58059"
},
{
"category": "external",
"summary": "RHBZ#2510250",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510250"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b",
"url": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059"
}
],
"release_date": "2026-08-03T02:41:30.973000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names"
},
{
"cve": "CVE-2026-59903",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-08-17T18:11:22.687313+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517538"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. The `CorsHandler` component incorrectly replaces application `Vary` headers, such as `Authorization` or `Cookie`, with `Origin`. This allows a caching proxy or Content Delivery Network (CDN) to reuse authenticated responses across different users, leading to the disclosure of sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact information disclosure flaw in Netty arises from the `CorsHandler` incorrectly overwriting application `Vary` headers with `Origin`. This could allow caching proxies or CDNs to reuse authenticated responses across different users, potentially exposing sensitive data. Exploitation requires the presence of a caching proxy or CDN in front of the affected Netty application.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59903"
},
{
"category": "external",
"summary": "RHBZ#2517538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517538"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59903"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17213",
"url": "https://github.com/netty/netty/pull/17213"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17217",
"url": "https://github.com/netty/netty/pull/17217"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46",
"url": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"
}
],
"release_date": "2026-08-17T17:56:28.726000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite"
},
{
"cve": "CVE-2026-75595",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"discovery_date": "2026-08-19T21:20:58.535091+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Netty that allows an unauthenticated remote attacker to bypass mutual TLS authentication. Applications that use Netty and rely solely on SNI-based clientAuth=REQUIRE for access control, without additional application-layer certificate verification, are vulnerable when an attacker exploits fragmented TLS ClientHello messages to force a fallback to a less secure default SslContext. Deployments that enforce clientAuth=REQUIRE uniformly across all SslContexts, or that perform secondary certificate verification at the application layer, are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75595"
},
{
"category": "external",
"summary": "RHBZ#2519953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961",
"url": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17213",
"url": "https://github.com/netty/netty/pull/17213"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17217",
"url": "https://github.com/netty/netty/pull/17217"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"
}
],
"release_date": "2026-08-19T21:00:27.627000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that application-layer certificate verification is implemented for services utilizing Netty with mutual TLS. This provides an additional layer of authentication beyond the TLS handshake, preventing unauthorized access even if the SNI routing is bypassed and a less restrictive default SslContext is used.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"
},
{
"cve": "CVE-2026-77874",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command"
},
"discovery_date": "2026-08-11T01:30:47.988000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513748"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. An authenticated remote attacker can bypass authorization controls and exfiltrate data from the underlying database by injecting SQL through the JSON path parameter in Hibernate ORM. This is due to improper escaping of the leading JSON path segment in certain database dialects, which is reachable in default configurations of applications using Hibernate ORM\u0027s Criteria API.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77874"
},
{
"category": "external",
"summary": "RHBZ#2513748",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513748"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77874"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874"
}
],
"release_date": "2026-09-17T13:30:48+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, applications using Hibernate ORM should avoid passing untrusted user-controlled input directly as JSON path arguments to `json_query`, `json_exists`, or `json_value` functions. If dynamic JSON querying is necessary, strictly validate or whitelist the JSON path input against a predefined pattern (e.g., allowing only alphanumeric characters and dots) before use.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass"
},
{
"cve": "CVE-2026-82965",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-08-31T12:26:56+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2526302"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by an unauthenticated remote attacker. Successful exploitation allows an attacker to cause a complete denial of service by crashing the Keycloak process. The vulnerability\u0027s root cause is the lack of proper size and element count validation for XML payloads processed by the SAML SOAP endpoints.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-82965"
},
{
"category": "external",
"summary": "RHBZ#2526302",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526302"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-82965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82965"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82965",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82965"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-92855",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-09-16T13:45:07+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535814"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to obtain a valid signed SAML assertion issued for a victim. Successful exploitation allows an attacker to bypass authentication and impersonate users within the Keycloak environment. The vulnerability\u0027s root cause is the failure of the SAML broker to enforce proof of key possession when processing holder-of-key assertions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92855"
},
{
"category": "external",
"summary": "RHBZ#2535814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92855",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92855"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession"
},
{
"acknowledgments": [
{
"names": [
"Eurico Nicacio"
],
"organization": "independent"
}
],
"cve": "CVE-2026-92857",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-16T16:34:59+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535817"
}
],
"notes": [
{
"category": "description",
"text": "Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to possess a valid Initial Access Token and a realm account. Successful exploitation allows an attacker to forge identity claims in signed tokens, leading to user impersonation across access tokens, ID tokens, and UserInfo responses. The vulnerability\u0027s root cause is a lack of validation for the claim.name field in protocol mapper configurations during Dynamic Client Registration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92857"
},
{
"category": "external",
"summary": "RHBZ#2535817",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535817"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92857"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92857",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92857"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens"
},
{
"cve": "CVE-2026-93488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:39:48+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536887"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in Netty\u0027s SpdySessionHandler that could allow a remote attacker to exhaust system resources by sending a large number of SPDY SYN_STREAM frames. This can lead to an OutOfMemoryError and crash the affected service, impacting availability. The default configuration allows for an unlimited number of concurrent streams, making services using Netty with SPDY vulnerable to this resource exhaustion attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93488"
},
{
"category": "external",
"summary": "RHBZ#2536887",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536887"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:39:48+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams"
},
{
"cve": "CVE-2026-93491",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:40:47+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536891"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HttpServerCodec component. A remote, unauthenticated attacker can exploit this flaw by sending a series of pipelined HTTP/1.1 requests without reading responses, leading to unbounded memory growth and potential service unavailability in applications utilizing affected Netty versions. The issue stems from an unbounded queue used to track pipelined requests, which can be exhausted by a malicious client.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93491"
},
{
"category": "external",
"summary": "RHBZ#2536891",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536891"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93491"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:40:47+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue"
},
{
"cve": "CVE-2026-93492",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:41:18+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536895"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate-impact flaw in Netty\u0027s HTTP/2 HpackEncoder allows a remote attacker to cause a Denial of Service. By sending specially crafted HTTP/2 SETTINGS frames with an oversized header table, an attacker can force the server to consume excessive CPU and memory resources, degrading service availability. This vulnerability affects applications utilizing Netty for HTTP/2 communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93492"
},
{
"category": "external",
"summary": "RHBZ#2536895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536895"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492"
}
],
"release_date": "2026-09-10T00:41:18+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size"
},
{
"cve": "CVE-2026-93558",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:42:37+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit unbounded queue growth by sending pipelined HTTP/1.1 requests to a server supporting WebSocket compression. This can lead to JVM heap exhaustion and a denial of service, as memory is not reclaimed until the connection closes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93558"
},
{
"category": "external",
"summary": "RHBZ#2536932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536932"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558"
}
],
"release_date": "2026-09-10T00:42:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service"
},
{
"cve": "CVE-2026-93562",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:45:54+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536951"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP/1 decoder allows HTTP request smuggling by incorrectly validating `Transfer-Encoding` headers. This can enable an attacker to inject arbitrary HTTP requests, primarily impacting Red Hat products deployed in environments with parser-differential proxies or load balancers, such as Red Hat AMQ, JBoss Fuse, Enterprise Application Platform, and Red Hat Build of Quarkus. The vulnerability arises from an incomplete fix, making it crucial to ensure consistent HTTP parsing across all network components.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93562"
},
{
"category": "external",
"summary": "RHBZ#2536951",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536951"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93562"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562"
}
],
"release_date": "2026-09-10T00:45:54+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling"
},
{
"cve": "CVE-2026-93564",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:46:51+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important. It allows a remote, unauthenticated attacker to cause a denial of service by sending specially crafted PROXY-protocol v2 headers to a service utilizing the `netty-codec-haproxy` component. Repeated malformed requests can lead to memory exhaustion due to a reference-count leak in the `HAProxyMessageDecoder`, impacting the availability of affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93564"
},
{
"category": "external",
"summary": "RHBZ#2536953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93564"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564"
}
],
"release_date": "2026-09-10T00:46:51+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)"
},
{
"cve": "CVE-2026-93565",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:47:19+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw affecting Netty-based RTSP servers and proxies. The `RtspDecoder` component incorrectly strips trailing control bytes from RTSP method tokens, allowing an attacker to bypass method-based access controls. This can lead to unauthorized actions or proxy laundering, where a malformed request is normalized and forwarded as legitimate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93565"
},
{
"category": "external",
"summary": "RHBZ#2536952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93565"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565"
}
],
"release_date": "2026-09-10T00:47:19+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte"
},
{
"cve": "CVE-2026-93566",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:47:37+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536954"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP codec allows HTTP request smuggling. The vulnerability stems from improper validation of chunk size lines, enabling an attacker to inject arbitrary HTTP requests. This could lead to cache poisoning or bypassing security controls in Red Hat products that use affected Netty components and process untrusted HTTP traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93566"
},
{
"category": "external",
"summary": "RHBZ#2536954",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536954"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93566"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566"
}
],
"release_date": "2026-09-10T00:47:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line"
},
{
"cve": "CVE-2026-93567",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:48:08+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536955"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Netty\u0027s HTTP/1-to-HTTP/2 conversion can lead to an integrity loss in Red Hat products configured as HTTP/1-to-HTTP/2 proxies or gateways. A remote attacker can manipulate the Host header in an HTTP/1 CONNECT request, causing the HTTP/2 CONNECT request to use an attacker-controlled authority. This bypasses security controls such as tunnel allow-lists and egress policies, allowing connections to unintended upstream targets.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93567"
},
{
"category": "external",
"summary": "RHBZ#2536955",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536955"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567"
}
],
"release_date": "2026-09-10T00:48:08+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority"
},
{
"cve": "CVE-2026-93568",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:50:42+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536961"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty\u0027s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where Netty\u0027s HTTP/2 and HTTP/3 HTTP-object conversion paths incorrectly downgrade Extended CONNECT requests to standard HTTP/1.1 CONNECT requests. This can lead to authorization bypasses in Red Hat products acting as gateways, proxies, or application servers that utilize Netty\u0027s HTTP-object adapters, as critical protocol and path information is lost, preventing proper policy enforcement.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93568"
},
{
"category": "external",
"summary": "RHBZ#2536961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536961"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93568"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568"
}
],
"release_date": "2026-09-10T00:50:42+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests"
},
{
"cve": "CVE-2026-93569",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-09-10T00:51:06+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty\u0027s HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Netty-based HTTP/1 to HTTP/2 proxies or gateways allows an unauthenticated remote attacker to bypass security policies. The inconsistency in translating the HTTP/1 Host header to HTTP/2 :authority can lead to host or tenant security boundary bypasses, cache poisoning, or unintended request routing, despite initial security checks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93569"
},
{
"category": "external",
"summary": "RHBZ#2536962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93569"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569"
}
],
"release_date": "2026-09-10T00:51:06+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority"
},
{
"cve": "CVE-2026-93573",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-09-10T00:52:26+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in Netty\u0027s HTTP/1.1 decoder allows for HTTP request smuggling by incorrectly processing split `Transfer-Encoding` headers. When Netty is deployed with an intermediary that interprets these headers differently, an attacker could bypass front-end security controls or desynchronize request processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93573"
},
{
"category": "external",
"summary": "RHBZ#2536964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93573",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93573"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573"
}
],
"release_date": "2026-09-10T00:52:26+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling"
},
{
"cve": "CVE-2026-93574",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-09-10T00:52:52+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536966"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity flaw in Netty\u0027s HTTP/1.1 chunk-size parsing allows for HTTP request smuggling in proxy/backend deployments. By accepting post-digit whitespace in chunk-size tokens, Netty can misinterpret malformed chunked bodies, leading to a desynchronization between Netty and other HTTP components in the request path. This could enable an attacker to smuggle requests, potentially bypassing security controls or accessing unauthorized resources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93574"
},
{
"category": "external",
"summary": "RHBZ#2536966",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536966"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93574"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574"
}
],
"release_date": "2026-09-10T00:52:52+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing"
},
{
"cve": "CVE-2026-93579",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:55:17+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP/2 implementation arises from disabled-by-default header value validation. When Netty-based applications act as HTTP/2 to HTTP/1.1 translation proxies or gateways, this can enable request smuggling or response splitting attacks by allowing prohibited control characters to be injected into HTTP/1.1 headers. Pure end-to-end HTTP/2 deployments are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93579"
},
{
"category": "external",
"summary": "RHBZ#2536970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579"
}
],
"release_date": "2026-09-10T00:55:17+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)"
},
{
"acknowledgments": [
{
"names": [
"SECTION: Create Trackers yes"
]
}
],
"cve": "CVE-2026-93998",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-09-18T14:55:12+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2537164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the specific condition of a shared signing key between trusted and untrusted issuers. Successful exploitation allows an attacker to bypass authentication and gain unauthorized access, including administrative privileges, to applications protected by the Keycloak SAML adapter. The vulnerability\u0027s root cause is the failure to validate the SAML assertion issuer against the configured identity provider entity ID.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93998"
},
{
"category": "external",
"summary": "RHBZ#2537164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93998",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93998"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93998",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93998"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer"
},
{
"acknowledgments": [
{
"names": [
"Paul Bottinelli"
],
"organization": "Trail of Bits in collaboration with OpenAI"
}
],
"cve": "CVE-2026-96453",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-22T12:44:17+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539294"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to be in a position to intercept network traffic and the administrator to be using a custom truststore configuration. Successful exploitation allows an attacker to capture administrative credentials and perform unauthorized administrative actions on the Keycloak server. The vulnerability root cause is the improper implementation of the trust strategy in the Admin CLI HTTP client, which defaults to accepting self-signed certificates when a truststore is provided.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96453"
},
{
"category": "external",
"summary": "RHBZ#2539294",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539294"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96453"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96453",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96453"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates"
},
{
"cve": "CVE-2026-96547",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-09-23T12:30:28+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539387"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a valid Initial Access Token and only impacts external relying parties that rely on token claims for authorization. Successful exploitation allows an attacker to forge realm roles in tokens issued to these parties, potentially leading to privilege escalation. The vulnerability\u0027s root cause is a lack of claim name restriction during the Dynamic Client Registration process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96547"
},
{
"category": "external",
"summary": "RHBZ#2539387",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539387"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96547"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96547",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96547"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles"
},
{
"acknowledgments": [
{
"names": [
"ProofSpear Security Labs"
],
"organization": "research@proofspear.io"
}
],
"cve": "CVE-2026-97175",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-09-23T14:46:34+00:00",
"notes": [
{
"category": "description",
"text": "A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim\u0027s account by using a matching unverified email address at a brokered provider.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that an attacker must possess an account at a brokered identity provider. Successful exploitation allows an attacker to perform a full account takeover, including changing the victim\u0027s email and password. The vulnerability\u0027s root cause is the failure to verify the email verified claim before automatically linking and authenticating a federated identity to an existing local account.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97175"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover"
},
{
"cve": "CVE-2026-97367",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-09-24T13:48:46+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540080"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user\u0027s active session. This allows the attacker to access and modify the victim\u0027s account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to possess client registration privileges and relies on specific session timing and user interaction. Successful exploitation allows an attacker to read and modify victim account data, potentially leading to full account takeover. The vulnerability\u0027s root cause is the lack of validation between the token subject and the resolved session user, combined with the ability to map sensitive claims like sid via DCR.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97367"
},
{
"category": "external",
"summary": "RHBZ#2540080",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540080"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97367"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97367",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97367"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover"
},
{
"cve": "CVE-2026-97847",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-09-24T15:48:58+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540950"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to possess specific client management privileges and knowledge of administrative identifiers. Successful exploitation allows an attacker to obtain full realm administrator authority, enabling them to read, modify, or delete any data within the affected realm. The vulnerability\u0027s root cause is an improper identity resolution mechanism that fails to validate the integrity of identity claims in sessionless tokens when protocol mappers are applied.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97847"
},
{
"category": "external",
"summary": "RHBZ#2540950",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540950"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97847",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97847"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97847",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97847"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority"
},
{
"acknowledgments": [
{
"names": [
"Katika Mohaseen"
],
"organization": "GitHub: h1-mrz"
}
],
"cve": "CVE-2026-97848",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-24T13:41:47+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540960"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to have existing client registration privileges or a valid Initial Access Token. Successful exploitation allows an attacker to forge client-role mappings in signed tokens, potentially leading to unauthorized access to resource servers. The vulnerability\u0027s root cause is an incomplete type check in the token sanitization logic that fails to account for Jackson ObjectNode values when jsonType=JSON is used.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97848"
},
{
"category": "external",
"summary": "RHBZ#2540960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540960"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97848",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97848"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97848",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97848"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization"
},
{
"cve": "CVE-2026-103112",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization"
},
"discovery_date": "2026-09-29T10:16:17+00:00",
"notes": [
{
"category": "description",
"text": "A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user\u0027s session. This can result in the attacker gaining full access to the victim\u0027s account and changing their password.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires a difficult-to-achieve race condition and specific realm configurations. Successful exploitation allows an attacker to perform a full account takeover, including changing the victim\u0027s password and accessing their data. The vulnerability\u0027s root cause is a failure to verify that an authenticator is appropriate for the active authentication flow, combined with insecure handling of concurrent session updates.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-103112"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-103112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103112"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103112",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103112"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path"
},
{
"acknowledgments": [
{
"names": [
"Animesh Roy"
]
}
],
"cve": "CVE-2026-107602",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-10-07T12:10:20+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2547937"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token\u0027s key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by an unauthenticated remote attacker under default configurations. Successful exploitation allows an attacker to exhaust server CPU resources and worker threads, leading to a complete denial of service. The vulnerability\u0027s root cause is an improper loop termination condition in the SAML 1.1 XML parser when encountering unhandled child elements.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-107602"
},
{
"category": "external",
"summary": "RHBZ#2547937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547937"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-107602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-107602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107602"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop"
},
{
"cve": "CVE-2026-110879",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558783"
}
],
"notes": [
{
"category": "description",
"text": "PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) [CVE-2026-110879]",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as an Important severity flaw because successful remote exploitation can result in arbitrary class instantiation and code execution, though it requires specific non-default deserialization patterns. For an application to be vulnerable, polymorphic type validation must be configured to process untrusted input with class-name identifiers, and exploitable gadget classes must exist on the classpath. In standard Red Hat product configurations, permissive class-name polymorphism is not enabled by default on external interfaces, significantly limiting exposure in typical production environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110879"
},
{
"category": "external",
"summary": "RHBZ#2558783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110879"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110879",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110879"
}
],
"release_date": "2026-10-20T22:44:36+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV"
},
{
"acknowledgments": [
{
"names": [
"Animesh Roy"
]
}
],
"cve": "CVE-2026-110931",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-10-14T12:56:48+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553047"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by a remote, unauthenticated attacker with a single request. Successful exploitation allows an attacker to cause a complete Denial of Service by terminating the JVM via memory exhaustion. The vulnerability\u0027s root cause is an infinite loop in the SAML 1.1 AuthorityBinding parsing logic, which was missed during the remediation of CVE-2026-7307.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110931"
},
{
"category": "external",
"summary": "RHBZ#2553047",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553047"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110931",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110931"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110931",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110931"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop"
},
{
"acknowledgments": [
{
"names": [
"0xNayel"
],
"organization": "YesWeHack Bug Bounty Program"
}
],
"cve": "CVE-2026-114232",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-10-19T12:07:08+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558074"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: UMA Protection API resourceType field not validated \u2014 cross-owner resource access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that an authenticated user can bypass resource ownership boundaries. Successful exploitation allows an attacker to gain unauthorized access to and potentially modify resources belonging to other users within the same realm. The vulnerabilitys root cause is a lack of validation for the resourceType field in the UMA Protection API during policy creation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.17"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114232"
},
{
"category": "external",
"summary": "RHBZ#2558074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114232"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114232",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114232"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:21:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95759"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.17"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: UMA Protection API resourceType field not validated \u2014 cross-owner resource access"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.