RHSA-2026:95760
Vulnerability from csaf_redhat - Published: 2026-11-06 10:22 - Updated: 2026-11-06 19:55Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.4.17 Images Security Update
Severity
Important
Notes
Topic: New images are available for Red Hat build of Keycloak 26.4.17 and Red Hat build of Keycloak 26.4.17 Operator, running on OpenShift Container Platform
Details: Red Hat build of Keycloak is an integrated sign-on solution,
available as a Red Hat JBoss Middleware for OpenShift containerized
image. The Red Hat build of Keycloak for OpenShift image provides
an authentication server that you can use to log in centrally, log
out, and register. You can also manage user accounts for web
applications, mobile applications, and RESTful web services.
Red Hat build of Keycloak Operator for OpenShift simplifies
deployment and management of Keycloak 26.4.17 clusters.
This erratum releases new images for Red Hat build of Keycloak
26.4.17 for use within the OpenShift Container Platform cloud
computing Platform-as-a-Service (PaaS) for on-premise or private
cloud deployments, aligning with the standalone product release.
Security fixes:
* Account takeover via authentication race using reset-credentials path (CVE-2026-103112)
* Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602)
* PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879)
* Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931)
* UMA Protection API resourceType field not validated — cross-owner resource access (CVE-2026-114232)
* Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)
* Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506)
* SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217)
* Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611)
* Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)
* Information disclosure via CORS Vary header overwrite (CVE-2026-59903)
* SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)
* SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874)
* Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965)
* Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763)
* SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855)
* DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857)
* Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488)
* Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491)
* HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492)
* Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558)
* Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562)
* HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564)
* Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565)
* HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566)
* HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567)
* HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568)
* HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569)
* Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573)
* HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574)
* HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579)
* SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998)
* kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453)
* DCR registration-time claim-path gap allows forging realm_access.roles (CVE-2026-96547)
* Unverified IdP email auto-linking enables account takeover (CVE-2026-97175)
* DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367)
* Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847)
* Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Bouncy Castle for Java, a cryptographic library. An attacker can exploit this vulnerability by manipulating rfc822Name and URI fields within X.509 certificates using a trailing dot. This bypasses Name Constraints, potentially leading to spoofing or unauthorized access. Such an exploit impacts the integrity and confidentiality of communications.
7.4 (High)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability related to how the software processes lazy ASN.1 sequences, which can reset an internal nesting-depth guard. This issue could lead to a Denial of Service (DoS), making the affected system or application unavailable.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account.
CWE-20 - Improper Input ValidationAffected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
7.4 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. The `CorsHandler` component incorrectly replaces application `Vary` headers, such as `Authorization` or `Cookie`, with `Origin`. This allows a caching proxy or Content Delivery Network (CDN) to reuse authenticated responses across different users, leading to the disclosure of sensitive information.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.
7.4 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.
8.6 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
7.4 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.
8.1 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
5.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
8.2 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.
7.4 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
8.0 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
8.8 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.
6.4 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.
7.1 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Moderate
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) [CVE-2026-110879]
8.1 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
8.1 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-8763
Threats
Impact
Important
References
171 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New images are available for Red Hat build of Keycloak 26.4.17 and Red Hat build of Keycloak 26.4.17 Operator, running on OpenShift Container Platform",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Keycloak is an integrated sign-on solution,\navailable as a Red Hat JBoss Middleware for OpenShift containerized\nimage. The Red Hat build of Keycloak for OpenShift image provides\nan authentication server that you can use to log in centrally, log\nout, and register. You can also manage user accounts for web\napplications, mobile applications, and RESTful web services.\n\nRed Hat build of Keycloak Operator for OpenShift simplifies\ndeployment and management of Keycloak 26.4.17 clusters.\n\nThis erratum releases new images for Red Hat build of Keycloak\n26.4.17 for use within the OpenShift Container Platform cloud\ncomputing Platform-as-a-Service (PaaS) for on-premise or private\ncloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* Account takeover via authentication race using reset-credentials path (CVE-2026-103112)\n* Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602)\n* PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879)\n* Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931)\n* UMA Protection API resourceType field not validated \u2014 cross-owner resource access (CVE-2026-114232)\n* Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)\n* Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506)\n* SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217)\n* Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611)\n* Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)\n* Information disclosure via CORS Vary header overwrite (CVE-2026-59903)\n* SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)\n* SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874)\n* Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965)\n* Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763)\n* SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855)\n* DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857)\n* Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488)\n* Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491)\n* HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492)\n* Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558)\n* Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562)\n* HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564)\n* Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565)\n* HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566)\n* HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567)\n* HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568)\n* HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569)\n* Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573)\n* HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574)\n* HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579)\n* SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998)\n* kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453)\n* DCR registration-time claim-path gap allows forging realm_access.roles (CVE-2026-96547)\n* Unverified IdP email auto-linking enables account takeover (CVE-2026-97175)\n* DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367)\n* Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847)\n* Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:95760",
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95760.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.4.17 Images Security Update",
"tracking": {
"current_release_date": "2026-11-06T19:55:48+00:00",
"generator": {
"date": "2026-11-06T19:55:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:95760",
"initial_release_date": "2026-11-06T10:22:36+00:00",
"revision_history": [
{
"date": "2026-11-06T10:22:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-06T10:22:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T19:55:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Keycloak 26.4",
"product": {
"name": "Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:build_keycloak:26.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Keycloak"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"product_id": "rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-29"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-30"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"product_id": "rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-29"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-30"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64",
"product_id": "rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-29"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"product": {
"name": "rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"product_id": "rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=26.4.17-2"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-30"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"product_id": "rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-29"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-30"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64"
},
"product_reference": "rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64",
"relates_to_product_reference": "9Base-RHBK-26.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-8763",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-03T02:01:23.973629+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510198"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java, a cryptographic library. An attacker can exploit this vulnerability by manipulating rfc822Name and URI fields within X.509 certificates using a trailing dot. This bypasses Name Constraints, potentially leading to spoofing or unauthorized access. Such an exploit impacts the integrity and confidentiality of communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Bouncy Castle for Java, a cryptographic library used across various Red Hat products. The vulnerability allows an attacker to bypass Name Constraints in X.509 certificates by manipulating rfc822Name and URI fields with a trailing dot. This bypass could lead to spoofing or unauthorized access, impacting the integrity and confidentiality of communications in affected Red Hat environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8763"
},
{
"category": "external",
"summary": "RHBZ#2510198",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510198"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8763",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8763"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558",
"url": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-8763",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-8763"
}
],
"release_date": "2026-08-03T00:36:05.088000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI"
},
{
"cve": "CVE-2026-12860",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-08-03T04:01:02.591427+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A signature verification flaw was found in Bouncy Castle for Java\u0027s RSA PKCS#1 parser (`bcprov`). When verifying RSA PKCS#1 v1.5 signatures utilizing a NULL-omitted DigestInfo path, the verification routine incorrectly skips the last two bytes of the expected digest hash. An unauthenticated remote attacker can exploit this truncated comparison to craft forged signatures that pass verification, bypassing cryptographic integrity controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12860"
},
{
"category": "external",
"summary": "RHBZ#2510256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396",
"url": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860"
}
],
"release_date": "2026-08-03T02:55:58.379000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Enforce strict DigestInfo encoding checks requiring explicit ASN.1 NULL parameters in RSA PKCS#1 v1.5 signature verification, or mandate the use of RSA-PSS signature schemes in application TLS/crypto configuration.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification"
},
{
"cve": "CVE-2026-13506",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-03T04:01:05.710651+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510257"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability related to how the software processes lazy ASN.1 sequences, which can reset an internal nesting-depth guard. This issue could lead to a Denial of Service (DoS), making the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Bouncy Castle for Java can lead to a denial of service. A remote attacker could exploit a vulnerability in how lazy ASN.1 sequences are processed, allowing the resetting of an internal nesting-depth guard. This could result in resource exhaustion and make affected applications unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13506"
},
{
"category": "external",
"summary": "RHBZ#2510257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13506",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13506"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13506",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13506"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84",
"url": "https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-13506",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"
}
],
"release_date": "2026-08-03T02:56:49.476000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-18217",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-07-28T12:03:23+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2508311"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker\u0027s parameters. This can cause some service providers to process the attacker\u0027s data instead of the real login information, potentially leading to a user being logged into the wrong account.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific client configuration (wildcard redirect URIs) and a downstream service provider that incorrectly handles duplicate HTTP parameters. Successful exploitation allows an attacker to perform login CSRF or session swapping on the affected service provider. The vulnerability\u0027s root cause is the improper handling of the query string in the SAML HTTP-Redirect binding response, which fails to strip or validate pre-existing SAML parameters.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18217"
},
{
"category": "external",
"summary": "RHBZ#2508311",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508311"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18217"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18217",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18217"
}
],
"release_date": "2026-07-28T12:03:23+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution"
},
{
"acknowledgments": [
{
"names": [
"LiuBo-keep (aidan)"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-19611",
"cwe": {
"id": "CWE-173",
"name": "Improper Handling of Alternate Encoding"
},
"discovery_date": "2026-07-24T14:34:50+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514568"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue has Moderate impact. Successful exploitation depends on accounts using fullwidth or other NFKC-compatibility characters in passwords and on the feasibility of password guessing against the deployed hash algorithm. Red Hat products that ship org.wildfly.security:wildfly-elytron-password-impl may be affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19611"
},
{
"category": "external",
"summary": "RHBZ#2514568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514568"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19611",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19611"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611"
}
],
"release_date": "2026-07-24T14:34:50+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding"
},
{
"cve": "CVE-2026-58059",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-08-03T03:02:32.846217+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510250"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An algorithmic complexity vulnerability was found in Bouncy Castle for Java. The library performs quadratic-time escaping while stringifying X.500 distinguished names. An unauthenticated remote attacker can exploit this by passing a specially crafted X.500 distinguished name\u2014such as within an X.509 certificate during TLS handshakes or PKI parsing operations\u2014forcing high CPU resource consumption. This execution causes processing delays and leads to Denial of Service (DoS) for applications parsing untrusted distinguished names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58059"
},
{
"category": "external",
"summary": "RHBZ#2510250",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510250"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b",
"url": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059"
}
],
"release_date": "2026-08-03T02:41:30.973000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names"
},
{
"cve": "CVE-2026-59903",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-08-17T18:11:22.687313+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517538"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. The `CorsHandler` component incorrectly replaces application `Vary` headers, such as `Authorization` or `Cookie`, with `Origin`. This allows a caching proxy or Content Delivery Network (CDN) to reuse authenticated responses across different users, leading to the disclosure of sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact information disclosure flaw in Netty arises from the `CorsHandler` incorrectly overwriting application `Vary` headers with `Origin`. This could allow caching proxies or CDNs to reuse authenticated responses across different users, potentially exposing sensitive data. Exploitation requires the presence of a caching proxy or CDN in front of the affected Netty application.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59903"
},
{
"category": "external",
"summary": "RHBZ#2517538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517538"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59903"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17213",
"url": "https://github.com/netty/netty/pull/17213"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17217",
"url": "https://github.com/netty/netty/pull/17217"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46",
"url": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"
}
],
"release_date": "2026-08-17T17:56:28.726000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite"
},
{
"cve": "CVE-2026-75595",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"discovery_date": "2026-08-19T21:20:58.535091+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Netty that allows an unauthenticated remote attacker to bypass mutual TLS authentication. Applications that use Netty and rely solely on SNI-based clientAuth=REQUIRE for access control, without additional application-layer certificate verification, are vulnerable when an attacker exploits fragmented TLS ClientHello messages to force a fallback to a less secure default SslContext. Deployments that enforce clientAuth=REQUIRE uniformly across all SslContexts, or that perform secondary certificate verification at the application layer, are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75595"
},
{
"category": "external",
"summary": "RHBZ#2519953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961",
"url": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17213",
"url": "https://github.com/netty/netty/pull/17213"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17217",
"url": "https://github.com/netty/netty/pull/17217"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"
}
],
"release_date": "2026-08-19T21:00:27.627000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that application-layer certificate verification is implemented for services utilizing Netty with mutual TLS. This provides an additional layer of authentication beyond the TLS handshake, preventing unauthorized access even if the SNI routing is bypassed and a less restrictive default SslContext is used.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"
},
{
"cve": "CVE-2026-77874",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command"
},
"discovery_date": "2026-08-11T01:30:47.988000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513748"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. An authenticated remote attacker can bypass authorization controls and exfiltrate data from the underlying database by injecting SQL through the JSON path parameter in Hibernate ORM. This is due to improper escaping of the leading JSON path segment in certain database dialects, which is reachable in default configurations of applications using Hibernate ORM\u0027s Criteria API.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77874"
},
{
"category": "external",
"summary": "RHBZ#2513748",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513748"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77874"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874"
}
],
"release_date": "2026-09-17T13:30:48+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, applications using Hibernate ORM should avoid passing untrusted user-controlled input directly as JSON path arguments to `json_query`, `json_exists`, or `json_value` functions. If dynamic JSON querying is necessary, strictly validate or whitelist the JSON path input against a predefined pattern (e.g., allowing only alphanumeric characters and dots) before use.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass"
},
{
"cve": "CVE-2026-82965",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-08-31T12:26:56+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2526302"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by an unauthenticated remote attacker. Successful exploitation allows an attacker to cause a complete denial of service by crashing the Keycloak process. The vulnerability\u0027s root cause is the lack of proper size and element count validation for XML payloads processed by the SAML SOAP endpoints.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-82965"
},
{
"category": "external",
"summary": "RHBZ#2526302",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526302"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-82965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82965"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82965",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82965"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce XML payload size and element count validation during SAML SOAP request parsing before DOM tree construction: upgrade to Red Hat build of Keycloak 26.4.17, 26.6.8 (or the corresponding fixed Red Hat builds), which enforce XML payload size and element count limits when parsing incoming SAML SOAP requests, closing all 2 injection vectors (SAML Artifact Resolution SOAP requests with large or deeply nested XML payloads, SAML ECP SOAP requests containing millions of empty XML elements). Until patched, this is a concern on Keycloak deployments exposing SAML SOAP endpoints to unauthenticated network access, so Restrict network access to SAML SOAP endpoints such as /realms/{realm}/protocol/saml/resolve to trusted internal clients and reverse proxies. As a compensating measure, Configure systemd service watchdog and automatic restart directives to detect OutOfMemoryError process exits and restore Keycloak service availability and Implement rate limiting and connection throttling on SOAP requests targeting the SAML resolve endpoint to mitigate rapid heap exhaustion. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded XML parsing defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1204 Service Watchdog and Automatic Restart (systemd WatchdogSec/Restart) (medium)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-92855",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-09-16T13:45:07+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535814"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to obtain a valid signed SAML assertion issued for a victim. Successful exploitation allows an attacker to bypass authentication and impersonate users within the Keycloak environment. The vulnerability\u0027s root cause is the failure of the SAML broker to enforce proof of key possession when processing holder-of-key assertions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92855"
},
{
"category": "external",
"summary": "RHBZ#2535814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92855",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92855"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce proof of possession for bound keys in SAML identity broker subject-confirmation validation: upgrade to Keycloak 26.4.17 / 26.6.8 (or the corresponding fixed Red Hat builds), which enforce proof of possession for the bound key or reject assertions that contain only unvalidated holder-of-key confirmations, closing replaying intercepted SAML holder-of-key assertions. Until patched, this is a concern on Keycloak deployments configured as a SAML identity broker trusting upstream providers that issue holder-of-key assertions, so restrict and audit trusted upstream SAML identity providers issuing holder-of-key assertions to prevent interception and unauthorized replay of signed assertions. As a compensating measure, enforce mandatory secondary authentication factor in Keycloak post-federation to block login completion on replayed assertions. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing proof-of-possession verification flaw \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-801 Multi-Factor Authentication (MFA) (medium)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession"
},
{
"acknowledgments": [
{
"names": [
"Eurico Nicacio"
],
"organization": "independent"
}
],
"cve": "CVE-2026-92857",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-16T16:34:59+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535817"
}
],
"notes": [
{
"category": "description",
"text": "Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to possess a valid Initial Access Token and a realm account. Successful exploitation allows an attacker to forge identity claims in signed tokens, leading to user impersonation across access tokens, ID tokens, and UserInfo responses. The vulnerability\u0027s root cause is a lack of validation for the claim.name field in protocol mapper configurations during Dynamic Client Registration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92857"
},
{
"category": "external",
"summary": "RHBZ#2535817",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535817"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92857"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92857",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92857"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate protocol mapper claim.name configurations during Dynamic Client Registration to deny mapping to reserved identity claims: upgrade to Red Hat build of Keycloak 26.4.17, 26.6.8 (or the corresponding fixed Red Hat builds), which validate and reject protocol mapper configurations in Dynamic Client Registration that assign reserved claims to claim.name, closing all 2 injection vectors (Dynamic Client Registration protocol mapper configuration mapping user profile attributes to the sub claim, Dynamic Client Registration protocol mapper configuration mapping user profile attributes to the aud claim). Until patched, this is a concern on Keycloak deployments enabling Dynamic Client Registration where users possess an Initial Access Token and editable realm profile attributes, so restrict issuance of Initial Access Tokens, monitor new client registrations, and restrict user capabilities to edit profile attributes. As a compensating measure, detect unauthorized Dynamic Client Registration creations and protocol mapper changes by alerting on configuration drift against declared realm baselines and log Dynamic Client Registration events and mapper configurations to a SIEM to identify unauthorized clients mapping reserved token claims. These controls limit blast radius and contain exploitation, but they do not fix the underlying unvalidated protocol mapper claim.name defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens"
},
{
"cve": "CVE-2026-93488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:39:48+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536887"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in Netty\u0027s SpdySessionHandler that could allow a remote attacker to exhaust system resources by sending a large number of SPDY SYN_STREAM frames. This can lead to an OutOfMemoryError and crash the affected service, impacting availability. The default configuration allows for an unlimited number of concurrent streams, making services using Netty with SPDY vulnerable to this resource exhaustion attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93488"
},
{
"category": "external",
"summary": "RHBZ#2536887",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536887"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:39:48+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams"
},
{
"cve": "CVE-2026-93491",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:40:47+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536891"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HttpServerCodec component. A remote, unauthenticated attacker can exploit this flaw by sending a series of pipelined HTTP/1.1 requests without reading responses, leading to unbounded memory growth and potential service unavailability in applications utilizing affected Netty versions. The issue stems from an unbounded queue used to track pipelined requests, which can be exhausted by a malicious client.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93491"
},
{
"category": "external",
"summary": "RHBZ#2536891",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536891"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93491"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:40:47+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue"
},
{
"cve": "CVE-2026-93492",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:41:18+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536895"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate-impact flaw in Netty\u0027s HTTP/2 HpackEncoder allows a remote attacker to cause a Denial of Service. By sending specially crafted HTTP/2 SETTINGS frames with an oversized header table, an attacker can force the server to consume excessive CPU and memory resources, degrading service availability. This vulnerability affects applications utilizing Netty for HTTP/2 communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93492"
},
{
"category": "external",
"summary": "RHBZ#2536895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536895"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492"
}
],
"release_date": "2026-09-10T00:41:18+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size"
},
{
"cve": "CVE-2026-93558",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:42:37+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit unbounded queue growth by sending pipelined HTTP/1.1 requests to a server supporting WebSocket compression. This can lead to JVM heap exhaustion and a denial of service, as memory is not reclaimed until the connection closes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93558"
},
{
"category": "external",
"summary": "RHBZ#2536932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536932"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558"
}
],
"release_date": "2026-09-10T00:42:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service"
},
{
"cve": "CVE-2026-93562",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:45:54+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536951"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP/1 decoder allows HTTP request smuggling by incorrectly validating `Transfer-Encoding` headers. This can enable an attacker to inject arbitrary HTTP requests, primarily impacting Red Hat products deployed in environments with parser-differential proxies or load balancers, such as Red Hat AMQ, JBoss Fuse, Enterprise Application Platform, and Red Hat Build of Quarkus. The vulnerability arises from an incomplete fix, making it crucial to ensure consistent HTTP parsing across all network components.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93562"
},
{
"category": "external",
"summary": "RHBZ#2536951",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536951"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93562"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562"
}
],
"release_date": "2026-09-10T00:45:54+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling"
},
{
"cve": "CVE-2026-93564",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:46:51+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important. It allows a remote, unauthenticated attacker to cause a denial of service by sending specially crafted PROXY-protocol v2 headers to a service utilizing the `netty-codec-haproxy` component. Repeated malformed requests can lead to memory exhaustion due to a reference-count leak in the `HAProxyMessageDecoder`, impacting the availability of affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93564"
},
{
"category": "external",
"summary": "RHBZ#2536953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93564"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564"
}
],
"release_date": "2026-09-10T00:46:51+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)"
},
{
"cve": "CVE-2026-93565",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:47:19+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw affecting Netty-based RTSP servers and proxies. The `RtspDecoder` component incorrectly strips trailing control bytes from RTSP method tokens, allowing an attacker to bypass method-based access controls. This can lead to unauthorized actions or proxy laundering, where a malformed request is normalized and forwarded as legitimate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93565"
},
{
"category": "external",
"summary": "RHBZ#2536952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93565"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565"
}
],
"release_date": "2026-09-10T00:47:19+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte"
},
{
"cve": "CVE-2026-93566",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:47:37+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536954"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP codec allows HTTP request smuggling. The vulnerability stems from improper validation of chunk size lines, enabling an attacker to inject arbitrary HTTP requests. This could lead to cache poisoning or bypassing security controls in Red Hat products that use affected Netty components and process untrusted HTTP traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93566"
},
{
"category": "external",
"summary": "RHBZ#2536954",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536954"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93566"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566"
}
],
"release_date": "2026-09-10T00:47:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line"
},
{
"cve": "CVE-2026-93567",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:48:08+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536955"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Netty\u0027s HTTP/1-to-HTTP/2 conversion can lead to an integrity loss in Red Hat products configured as HTTP/1-to-HTTP/2 proxies or gateways. A remote attacker can manipulate the Host header in an HTTP/1 CONNECT request, causing the HTTP/2 CONNECT request to use an attacker-controlled authority. This bypasses security controls such as tunnel allow-lists and egress policies, allowing connections to unintended upstream targets.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93567"
},
{
"category": "external",
"summary": "RHBZ#2536955",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536955"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567"
}
],
"release_date": "2026-09-10T00:48:08+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority"
},
{
"cve": "CVE-2026-93568",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:50:42+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536961"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty\u0027s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where Netty\u0027s HTTP/2 and HTTP/3 HTTP-object conversion paths incorrectly downgrade Extended CONNECT requests to standard HTTP/1.1 CONNECT requests. This can lead to authorization bypasses in Red Hat products acting as gateways, proxies, or application servers that utilize Netty\u0027s HTTP-object adapters, as critical protocol and path information is lost, preventing proper policy enforcement.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93568"
},
{
"category": "external",
"summary": "RHBZ#2536961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536961"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93568"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568"
}
],
"release_date": "2026-09-10T00:50:42+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests"
},
{
"cve": "CVE-2026-93569",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-09-10T00:51:06+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty\u0027s HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Netty-based HTTP/1 to HTTP/2 proxies or gateways allows an unauthenticated remote attacker to bypass security policies. The inconsistency in translating the HTTP/1 Host header to HTTP/2 :authority can lead to host or tenant security boundary bypasses, cache poisoning, or unintended request routing, despite initial security checks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93569"
},
{
"category": "external",
"summary": "RHBZ#2536962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93569"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569"
}
],
"release_date": "2026-09-10T00:51:06+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority"
},
{
"cve": "CVE-2026-93573",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-09-10T00:52:26+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in Netty\u0027s HTTP/1.1 decoder allows for HTTP request smuggling by incorrectly processing split `Transfer-Encoding` headers. When Netty is deployed with an intermediary that interprets these headers differently, an attacker could bypass front-end security controls or desynchronize request processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93573"
},
{
"category": "external",
"summary": "RHBZ#2536964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93573",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93573"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573"
}
],
"release_date": "2026-09-10T00:52:26+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling"
},
{
"cve": "CVE-2026-93574",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-09-10T00:52:52+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536966"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity flaw in Netty\u0027s HTTP/1.1 chunk-size parsing allows for HTTP request smuggling in proxy/backend deployments. By accepting post-digit whitespace in chunk-size tokens, Netty can misinterpret malformed chunked bodies, leading to a desynchronization between Netty and other HTTP components in the request path. This could enable an attacker to smuggle requests, potentially bypassing security controls or accessing unauthorized resources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93574"
},
{
"category": "external",
"summary": "RHBZ#2536966",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536966"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93574"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574"
}
],
"release_date": "2026-09-10T00:52:52+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing"
},
{
"cve": "CVE-2026-93579",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:55:17+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP/2 implementation arises from disabled-by-default header value validation. When Netty-based applications act as HTTP/2 to HTTP/1.1 translation proxies or gateways, this can enable request smuggling or response splitting attacks by allowing prohibited control characters to be injected into HTTP/1.1 headers. Pure end-to-end HTTP/2 deployments are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93579"
},
{
"category": "external",
"summary": "RHBZ#2536970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579"
}
],
"release_date": "2026-09-10T00:55:17+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)"
},
{
"acknowledgments": [
{
"names": [
"SECTION: Create Trackers yes"
]
}
],
"cve": "CVE-2026-93998",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-09-18T14:55:12+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2537164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the specific condition of a shared signing key between trusted and untrusted issuers. Successful exploitation allows an attacker to bypass authentication and gain unauthorized access, including administrative privileges, to applications protected by the Keycloak SAML adapter. The vulnerability\u0027s root cause is the failure to validate the SAML assertion issuer against the configured identity provider entity ID.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93998"
},
{
"category": "external",
"summary": "RHBZ#2537164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93998",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93998"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93998",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93998"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce strict verification of the SAML assertion Issuer attribute against the configured identity provider entity ID in the Keycloak SAML adapter: upgrade to Red Hat build of Keycloak 26.4.17, 26.6.8 (or the corresponding fixed Red Hat builds), which verify that the Issuer attribute in the received SAML response and assertion strictly matches the configured identity provider entity ID, closing all 2 injection vectors (cross-tenant SAML assertion injection, shared-key sibling issuer assertion forging). Until patched, this is a concern on Applications secured using the Keycloak SAML adapter where signing keys are shared across multiple identity providers or tenants, so Ensure signing keys are strictly isolated per identity provider and never shared across multiple issuers or tenants. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing SAML issuer validation defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer"
},
{
"acknowledgments": [
{
"names": [
"Paul Bottinelli"
],
"organization": "Trail of Bits in collaboration with OpenAI"
}
],
"cve": "CVE-2026-96453",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-22T12:44:17+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539294"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to be in a position to intercept network traffic and the administrator to be using a custom truststore configuration. Successful exploitation allows an attacker to capture administrative credentials and perform unauthorized administrative actions on the Keycloak server. The vulnerability root cause is the improper implementation of the trust strategy in the Admin CLI HTTP client, which defaults to accepting self-signed certificates when a truststore is provided.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96453"
},
{
"category": "external",
"summary": "RHBZ#2539294",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539294"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96453"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96453",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96453"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to disable TrustSelfSignedStrategy in the Keycloak Admin CLI HTTP client configuration and enforce validation strictly against the configured custom truststore: upgrade to Red Hat build of Keycloak 26.4.17 / 26.6.8 (or the corresponding fixed Red Hat builds), which disable TrustSelfSignedStrategy in the HTTP client and enforce certificate verification against the provided truststore, closing all 2 injection vectors (Man-in-the-Middle network interception, DNS redirection). Until patched, this is a concern on Administrators executing kcadm with a custom truststore option, so Avoid executing kcadm with custom truststores across untrusted networks, and restrict network paths and DNS resolution between client hosts and Keycloak endpoints. As a compensating measure, Cryptographically verify DNS response authenticity using DNSSEC validation to prevent DNS redirection to unauthorized servers and Isolate administrative traffic between kcadm clients and Keycloak servers into dedicated VLANs or subnets to prevent network interception. These controls limit blast radius and contain exploitation, but they do not fix the underlying certificate validation defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-203 Network Segmentation (VLANs/Subnets) (medium)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates"
},
{
"cve": "CVE-2026-96547",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-09-23T12:30:28+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539387"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a valid Initial Access Token and only impacts external relying parties that rely on token claims for authorization. Successful exploitation allows an attacker to forge realm roles in tokens issued to these parties, potentially leading to privilege escalation. The vulnerability\u0027s root cause is a lack of claim name restriction during the Dynamic Client Registration process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96547"
},
{
"category": "external",
"summary": "RHBZ#2539387",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539387"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96547"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96547",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96547"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles"
},
{
"acknowledgments": [
{
"names": [
"ProofSpear Security Labs"
],
"organization": "research@proofspear.io"
}
],
"cve": "CVE-2026-97175",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-09-23T14:46:34+00:00",
"notes": [
{
"category": "description",
"text": "A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim\u0027s account by using a matching unverified email address at a brokered provider.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that an attacker must possess an account at a brokered identity provider. Successful exploitation allows an attacker to perform a full account takeover, including changing the victim\u0027s email and password. The vulnerability\u0027s root cause is the failure to verify the email verified claim before automatically linking and authenticating a federated identity to an existing local account.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97175"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to require verification of the email verified claim before linking brokered identities to local accounts in the idp-auto-link authenticator: upgrade to Red Hat build of Keycloak 26.4.17 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which verify the email verified claim before automatically linking an incoming brokered identity to an existing local account, closing federated identity login using unverified matching email address. Until patched, this is a concern on Keycloak deployments configured with the idp-auto-link authenticator in the first-broker-login flow, so audit brokered external identity providers to ensure they enforce email verification, or avoid using external providers that permit arbitrary unverified email addresses matching existing local accounts. As a compensating measure, Enforce multi-factor authentication on target Keycloak accounts to prevent attackers from completing account takeovers even if the federated identity is automatically linked. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper authentication defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-801 Multi-Factor Authentication (MFA) (medium)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover"
},
{
"cve": "CVE-2026-97367",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-09-24T13:48:46+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540080"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user\u0027s active session. This allows the attacker to access and modify the victim\u0027s account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to possess client registration privileges and relies on specific session timing and user interaction. Successful exploitation allows an attacker to read and modify victim account data, potentially leading to full account takeover. The vulnerability\u0027s root cause is the lack of validation between the token subject and the resolved session user, combined with the ability to map sensitive claims like sid via DCR.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97367"
},
{
"category": "external",
"summary": "RHBZ#2540080",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540080"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97367"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97367",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97367"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover"
},
{
"cve": "CVE-2026-97847",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-09-24T15:48:58+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540950"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to possess specific client management privileges and knowledge of administrative identifiers. Successful exploitation allows an attacker to obtain full realm administrator authority, enabling them to read, modify, or delete any data within the affected realm. The vulnerability\u0027s root cause is an improper identity resolution mechanism that fails to validate the integrity of identity claims in sessionless tokens when protocol mappers are applied.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97847"
},
{
"category": "external",
"summary": "RHBZ#2540950",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540950"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97847",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97847"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97847",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97847"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent identity resolution in Keycloak from reconstructing authenticated UserModel principals from post-mapper claims in sessionless service-account tokens: upgrade to Keycloak 26.4.17, 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which validates the integrity of identity claims in sessionless service-account tokens and prevents resolving authenticated identities from manipulated post-mapper claims, closing all 2 injection vectors (hardcoded-claim protocol mapper manipulation, sessionless token principal substitution). Until patched, this is a concern on Keycloak deployments with OIDC clients configured for sessionless service-account tokens where delegated users hold manage-clients permissions, so Audit and restrict manage-clients permissions on OIDC clients, avoid using sessionless service-account tokens, and monitor client protocol mappers for unauthorized sub or preferred_username overrides. As a compensating measure, Detect unauthorized addition of hardcoded-claim protocol mappers to Keycloak OIDC client configurations by monitoring application configurations against a declared baseline via drift detection. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper identity resolution defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1007 Application Configuration Drift Detection (IaC Enforcement) (medium)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority"
},
{
"acknowledgments": [
{
"names": [
"Katika Mohaseen"
],
"organization": "GitHub: h1-mrz"
}
],
"cve": "CVE-2026-97848",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-24T13:41:47+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540960"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to have existing client registration privileges or a valid Initial Access Token. Successful exploitation allows an attacker to forge client-role mappings in signed tokens, potentially leading to unauthorized access to resource servers. The vulnerability\u0027s root cause is an incomplete type check in the token sanitization logic that fails to account for Jackson ObjectNode values when jsonType=JSON is used.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97848"
},
{
"category": "external",
"summary": "RHBZ#2540960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540960"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97848",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97848"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97848",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97848"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization"
},
{
"cve": "CVE-2026-103112",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization"
},
"discovery_date": "2026-09-29T10:16:17+00:00",
"notes": [
{
"category": "description",
"text": "A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user\u0027s session. This can result in the attacker gaining full access to the victim\u0027s account and changing their password.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires a difficult-to-achieve race condition and specific realm configurations. Successful exploitation allows an attacker to perform a full account takeover, including changing the victim\u0027s password and accessing their data. The vulnerability\u0027s root cause is a failure to verify that an authenticator is appropriate for the active authentication flow, combined with insecure handling of concurrent session updates.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-103112"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-103112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103112"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103112",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103112"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate that the requested authenticator ID belongs to the active execution flow when switching between authenticate and reset-credentials endpoints in keycloak-services: upgrade to Red Hat build of Keycloak 26.4.17, 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which validate that the requested authenticator ID is present in the active execution flow when switching between authenticate and reset-credentials endpoints, closing concurrent race condition between reset-credentials and authenticate endpoints during flow switching. Until patched, this is a concern on Keycloak deployments with Forgot Credentials enabled and users without two-factor authentication, so Enforce two-factor authentication for all realm users or disable the Forgot Credentials feature to prevent cross-flow identity binding. These controls limit blast radius and contain exploitation, but they do not fix the underlying authentication race condition defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-801 Multi-Factor Authentication (MFA) (high)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path"
},
{
"acknowledgments": [
{
"names": [
"Animesh Roy"
]
}
],
"cve": "CVE-2026-107602",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-10-07T12:10:20+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2547937"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token\u0027s key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by an unauthenticated remote attacker under default configurations. Successful exploitation allows an attacker to exhaust server CPU resources and worker threads, leading to a complete denial of service. The vulnerability\u0027s root cause is an improper loop termination condition in the SAML 1.1 XML parser when encountering unhandled child elements.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-107602"
},
{
"category": "external",
"summary": "RHBZ#2547937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547937"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-107602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-107602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107602"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to ensure the StAX-based XML parser in keycloak-saml-core advances the cursor or rejects unhandled child elements when parsing ds:KeyInfo in SAML 1.1 tokens: upgrade to Red Hat build of Keycloak 26.4.17, 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which advances the cursor or rejects unexpected child elements within ds:KeyInfo rather than repeatedly peeking without advancing the parser, closing crafted SAML 1.1 request containing unexpected ds:KeyInfo child elements. Until patched, this is a concern on Keycloak deployments exposing unauthenticated SAML endpoints, so Restrict network access to Keycloak SAML endpoints such as /realms/{realm}/protocol/saml to trusted clients. As a compensating measure, Configure systemd service watchdogs (WatchdogSec and Restart) to monitor responsiveness and automatically restart Keycloak when worker threads hang and Implement rate limiting and connection throttling on unauthenticated HTTP requests targeting Keycloak SAML endpoints to mitigate thread exhaustion. These controls limit blast radius and contain exploitation, but they do not fix the underlying infinite-loop XML parsing defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1204 Service Watchdog and Automatic Restart (systemd WatchdogSec/Restart) (medium)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop"
},
{
"cve": "CVE-2026-110879",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558783"
}
],
"notes": [
{
"category": "description",
"text": "PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) [CVE-2026-110879]",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as an Important severity flaw because successful remote exploitation can result in arbitrary class instantiation and code execution, though it requires specific non-default deserialization patterns. For an application to be vulnerable, polymorphic type validation must be configured to process untrusted input with class-name identifiers, and exploitable gadget classes must exist on the classpath. In standard Red Hat product configurations, permissive class-name polymorphism is not enabled by default on external interfaces, significantly limiting exposure in typical production environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110879"
},
{
"category": "external",
"summary": "RHBZ#2558783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110879"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110879",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110879"
}
],
"release_date": "2026-10-20T22:44:36+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV"
},
{
"acknowledgments": [
{
"names": [
"Animesh Roy"
]
}
],
"cve": "CVE-2026-110931",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-10-14T12:56:48+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553047"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by a remote, unauthenticated attacker with a single request. Successful exploitation allows an attacker to cause a complete Denial of Service by terminating the JVM via memory exhaustion. The vulnerability\u0027s root cause is an infinite loop in the SAML 1.1 AuthorityBinding parsing logic, which was missed during the remediation of CVE-2026-7307.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110931"
},
{
"category": "external",
"summary": "RHBZ#2553047",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553047"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110931",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110931"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110931",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110931"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to advance parser state past AuthorityBinding elements during SAML 1.1 AuthenticationStatement processing in keycloak-saml-core to halt unbounded heap allocation: upgrade to Keycloak 26.4.17, 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which advance the parser past AuthorityBinding child elements during SAML 1.1 AuthenticationStatement processing, closing all 2 injection vectors (crafted SAML request to realm SAML endpoint, crafted SAML request to SAML identity provider broker endpoint). Until patched, this is a concern on Keycloak deployments exposing realm SAML endpoints or SAML identity provider broker endpoints, so Restrict network access to Keycloak realm SAML endpoints and SAML identity provider broker endpoints to trusted networks and identity providers. As a compensating measure, Configure systemd WatchdogSec and Restart directives to automatically restart Keycloak following JVM OutOfMemoryError termination and Monitor cgroup memory.events and PSI metrics to detect anomalous memory pressure and rapid heap exhaustion. These controls limit blast radius and contain exploitation, but they do not fix the underlying SAML 1.1 parser infinite loop defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1204 Service Watchdog and Automatic Restart (systemd WatchdogSec/Restart) (medium)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop"
},
{
"acknowledgments": [
{
"names": [
"0xNayel"
],
"organization": "YesWeHack Bug Bounty Program"
}
],
"cve": "CVE-2026-114232",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-10-19T12:07:08+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558074"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: UMA Protection API resourceType field not validated \u2014 cross-owner resource access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that an authenticated user can bypass resource ownership boundaries. Successful exploitation allows an attacker to gain unauthorized access to and potentially modify resources belonging to other users within the same realm. The vulnerabilitys root cause is a lack of validation for the resourceType field in the UMA Protection API during policy creation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114232"
},
{
"category": "external",
"summary": "RHBZ#2558074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114232"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114232",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114232"
}
],
"release_date": "2026-11-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T10:22:36+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95760"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce ownership validation on the resourceType field within UserManagedPermissionService to prevent UMA policies from attaching to resources owned by other users: upgrade to Red Hat build of Keycloak 26.4.17, 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which validates the resourceType field during policy creation in UserManagedPermissionService to prevent policies from matching resources across different owners during evaluation in DefaultPolicyEvaluator, closing crafted UMA policy creation specifying an arbitrary victim resourceType. Until patched, this is a concern on Keycloak deployments exposing the UMA Protection API where authenticated realm users have permission to create and manage resources, so Restrict authenticated users from creating and managing resources, limit exposure of sensitive resourceType identifiers, and monitor policy definitions created via the UMA Protection API. As a compensating measure, Capture audit records when authenticated users create or modify authorization policies via the UMA Protection API to detect unauthorized cross-owner policy creation. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing authorization defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1006 Privilege Change Audit Logging (medium)",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: UMA Protection API resourceType field not validated \u2014 cross-owner resource access"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.