Red Hat Security Advisory

RHSA-2026:30049

Red Hat build of Keycloak 26.4.13 Security Update

Released 2026-06-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Keycloak 26.4.13

Fixes 36 records

TI-2026-30861 CVE-2026-42581 · GHSA-xxqh-mfjm-7mv9

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

HIGH 81

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0063 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30864 CVE-2026-42584 · GHSA-57rv-r2g8-2cj3

Netty: HttpClientCodec response desynchronization

HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00838 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30859 CVE-2026-42579 · GHSA-cm33-6792-r9fm

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01006 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-20

TI-2026-30867 CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0099 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-30863 CVE-2026-42583 · GHSA-mj4r-2hfc-f8p6

Netty: Lz4FrameDecoder resource exhaustion

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-06017 CVE-2026-6860 · GHSA-3g76-f9xq-8vp6

Improper certificate validation in Eclipse Vert.x

HIGH 70

A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00238 Published 2026-05-06 Partial fix · 4.5.27, 5.0.12 CWE-295

TI-2026-30858 CVE-2026-42578 · GHSA-45q3-82m4-75jr

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

MEDIUM 48

Netty is an asynchronous, event-driven network application framework.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.01065 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-113

TI-2026-35500 CVE-2026-48059 · GHSA-h2qv-fj59-j46j

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

MEDIUM 45

Netty is a network application framework for development of protocol servers and clients.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0063 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-401

TI-2026-35195 CVE-2026-47691 · GHSA-5pvg-856g-cp85

Netty has Insufficient Bailiwick Validation for NS Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00372 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2026-33416 CVE-2026-45674 · GHSA-676x-f7gg-47vc

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00292 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2026-33205 CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

MEDIUM 41

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00921 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-770

TI-2026-35485 CVE-2026-48043 · GHSA-c2gf-v879-257j

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00753 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-32768 CVE-2026-44893 · GHSA-cc37-9q2j-3hfv

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00617 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-703

TI-2026-08505 CVE-2026-9704 · GHSA-rr5q-3xwr-f323

Keycloak: keycloak: privilege escalation due to oversized subject_token jwt

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0032 Published 2026-05-27 Fixed in 26.4.13-1, 26.4-19 +3 CWE-1284

TI-2026-36836 CVE-2026-50010 · GHSA-c653-97m9-rcg9

Netty's wrapping plain trust manager silently disables hostname verification

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00491 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-347

TI-2026-32226 CVE-2026-44249 · GHSA-3qp7-7mw8-wx86

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00987 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-284

TI-2026-08588 CVE-2026-9800 · GHSA-79qw-g39g-mfxc · GHSA-f5p5-6xmx-p252

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

LOW 38

A flaw was found in Keycloak Policy Enforcer.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00651 Published 2026-06-25 Partial fix · 26.4.13-1, 26.4-19 +7 CWE-1025

TI-2026-07984 CVE-2026-9087 · GHSA-m6qj-3mpp-57v8

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

LOW 37

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00312 Published 2026-05-20 Fixed in 26.4.13-1, 26.4-19 +3 CWE-639

TI-2026-07996 CVE-2026-9099 · GHSA-rmcj-82cr-27rx

Keycloak: group-admin escalation to realm-admin

LOW 36

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.7 Network High privileges No interaction EPSS 0.0049 Published 2026-06-25 Fixed in 26.4.13-1, 26.4-19 +2 CWE-639

TI-2026-08506 CVE-2026-9705 · GHSA-q929-g23j-2rc7 · GHSA-r7rc-c989-86g6

Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token

LOW 35

A flaw was found in Keycloak's client registration service.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00464 Published 2026-06-25 Fixed in 26.4.13-1, 26.4-19 +3 CWE-613

TI-2026-07983 CVE-2026-9086 · GHSA-37j9-56gh-j2r7 · GHSA-v3f7-2p4r-mwfw

Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

LOW 35

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00781 Published 2026-06-25 Fixed in 26.4.13-1, 26.4-19 +3 CWE-79

TI-2026-08584 CVE-2026-9795 · GHSA-32h4-44jj-c5vx

Keycloak: keycloak: privilege escalation via improper scope mapping enforcement

LOW 34

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature.

CVSS 3.1HIGH 7.3 Network High privileges User interaction EPSS 0.00354 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-266

TI-2026-08581 CVE-2026-9792 · GHSA-33j3-g875-37rp

Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition

LOW 34

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00268 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-280

TI-2026-08590 CVE-2026-9802 · GHSA-v5g5-wwmp-jppw

Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart

LOW 32

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.003 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-613

TI-2026-08591 CVE-2026-9803 · GHSA-cpf7-j4cf-vqx4

Keycloak: keycloak: denial of service via malformed authorization header

LOW 30

A flaw was found in Keycloak's ClientRegistrationAuth component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00417 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-125

TI-2026-08583 CVE-2026-9794 · GHSA-fqjh-8322-vgrv

Keycloak: keycloak: information disclosure via saml ecp endpoint

LOW 30

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00436 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-209

TI-2026-28102 CVE-2026-37977 · GHSA-5v8v-xvjv-57x7

Origin validation error in Red Hat build of Keycloak 26.4

LOW 24

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00258 Published 2026-04-06 Fixed in 26.4.13-1, 26.4-19 +4 CWE-346

TI-2026-07980 CVE-2026-9083 · GHSA-7pm9-g8jh-3m74 · GHSA-9jrw-8xf7-xqhq

Keycloak: keycloak: information disclosure through arbitrary filesystem path probing

LOW 24

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0078 Published 2026-06-25 Fixed in 26.4.13-1, 26.4-19 +3 CWE-22

TI-2026-07843 CVE-2026-8922 · GHSA-83c4-ffjp-mxp9

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

LOW 24

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00281 Published 2026-05-19 Fixed in 26.4.13-1, 26.4-19 +2 CWE-303

TI-2026-06590 CVE-2026-7500 · GHSA-hm32-hfmw-rhvg

Org.keycloak.keycloak-services: improper access control on keycloak server when the…

LOW 24

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00232 Published 2026-04-30 Fixed in 26.4.13-1, 26.4-19 +2 CWE-425

TI-2026-08589 CVE-2026-9801 · GHSA-f6r7-6w34-x2gp

Keycloak: keycloak: denial of service via malformed ldap password policy response

LOW 23

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00477 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-1284

TI-2026-08587 CVE-2026-9799 · GHSA-gfv4-4vr2-rr4g · GHSA-w3p3-7cjg-vgfw

Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass

LOW 21

A flaw was found in org.keycloak.authorization.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00294 Published 2026-06-25 Fixed in 26.4.13-1, 26.4-19 +3 CWE-639

TI-2026-07754 CVE-2026-8830 · GHSA-g8vr-x4qh-25qg

Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn…

LOW 20

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00392 Published 2026-05-19 Fixed in 26.4.13-1, 26.4-19 +3 CWE-603

TI-2026-08580 CVE-2026-9791 · GHSA-4q93-v92x-p89f

Keycloak-rhel9: organization data leak after feature disabled in keycloak

LOW 19

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-863

TI-2026-04248 CVE-2026-4874 · GHSA-22rm-wp4x-v5cx

Server-side request forgery in Red Hat build of Keycloak 26.4

LOW 15

A flaw was found in Keycloak.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00353 Published 2026-03-26 Partial fix · 26.4.13-1, 26.4-19 +4 CWE-918

TI-2026-07985 CVE-2026-9088 · GHSA-6g26-7cx5-mrrg

Keycloak: keycloak: information disclosure due to user profile permission bypass

LOW 14

A flaw was found in org.keycloak.services.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00348 Published 2026-06-05 Fixed in 26.4.13-1, 26.4-19 +3 CWE-1220