Red Hat Security Advisory

RHSA-2026:76130

Red Hat Single Sign-On 7.6.13 security update on RHEL 9

Released 2026-10-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el9sso

Fixes 27 records

TI-2026-30861 CVE-2026-42581 · GHSA-xxqh-mfjm-7mv9

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

HIGH 81

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0063 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30859 CVE-2026-42579 · GHSA-cm33-6792-r9fm

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01006 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-20

TI-2026-48269 CVE-2026-68494 · GHSA-r7wm-3cxj-wff9

Resource allocation without limits in FasterXML jackson-core

HIGH 77

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00463 Published 2026-08-04 Partial fix · 2.18.8, 2.21.4 +1 CWE-770

TI-2025-11507 CVE-2025-12543 · GHSA-j382-5jj3-vw4j

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

HIGH 76

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01333 Published 2026-01-07 Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20

TI-2026-30867 CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0099 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-39358 CVE-2026-54512 · GHSA-j3rv-43j4-c7qm

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

HIGH 70

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01066 Published 2026-06-23 Partial fix · 2.18.8, 2.21.4 +1 CWE-184

TI-2026-30858 CVE-2026-42578 · GHSA-45q3-82m4-75jr

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

MEDIUM 48

Netty is an asynchronous, event-driven network application framework.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.01065 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-113

TI-2026-35500 CVE-2026-48059 · GHSA-h2qv-fj59-j46j

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

MEDIUM 45

Netty is a network application framework for development of protocol servers and clients.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0063 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-401

TI-2026-03020 CVE-2026-3505 · GHSA-cj8j-37rh-8475

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

MEDIUM 45

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00787 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +1 CWE-400

TI-2026-35195 CVE-2026-47691 · GHSA-5pvg-856g-cp85

Netty has Insufficient Bailiwick Validation for NS Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00372 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2026-33416 CVE-2026-45674 · GHSA-676x-f7gg-47vc

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00292 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2025-08973 CVE-2025-9784 · GHSA-95h4-w6j8-2rp8

Undertow: undertow madeyoureset http/2 ddos vulnerability

MEDIUM 43

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02325 Published 2025-09-02 Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770

TI-2025-13517 CVE-2025-14813 · GHSA-574f-3g2m-x479

GOSTCTR implementation unable to process more than 255 blocks correctly

MEDIUM 42

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0CRITICAL 9.3 Local No auth No interaction EPSS 0.0032 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +1 CWE-327

TI-2026-33205 CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

MEDIUM 41

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00921 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-770

TI-2026-35485 CVE-2026-48043 · GHSA-c2gf-v879-257j

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00753 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-32768 CVE-2026-44893 · GHSA-cc37-9q2j-3hfv

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00617 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-703

TI-2026-06414 CVE-2026-7307 · GHSA-p5mv-gj8j-xqgf

Keycloak: keycloak: denial of service via specially crafted saml input

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00878 Published 2026-05-19 Fixed in 26.2.16, 26.4.12 +9 CWE-1286

TI-2026-04036 CVE-2026-4634 · GHSA-h4wv-g838-66g3

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00638 Published 2026-04-02 Fixed in 26.2.15-1, 26.2-18 +7 CWE-1050

TI-2026-00404 CVE-2026-0603 · GHSA-2p5w-cvg5-gc5c

Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

MEDIUM 40

A flaw was found in Hibernate.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.01032 Published 2026-01-23 Partial fix · 5.1.17-4.Final_redhat_00005.1.ep7.el7, 7.1.14-4.GA_redhat_00003.1.ep7.el7 +13 CWE-89

TI-2026-36836 CVE-2026-50010 · GHSA-c653-97m9-rcg9

Netty's wrapping plain trust manager silently disables hostname verification

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00491 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-347

TI-2026-32226 CVE-2026-44249 · GHSA-3qp7-7mw8-wx86

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00987 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-284

TI-2026-13101 CVE-2026-15563 · GHSA-259j-555g-mwrr

Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

LOW 36

A flaw was found in EAP's IIOP.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00663 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +113 CWE-306

TI-2026-06597 CVE-2026-7507 · GHSA-hf67-5vvq-fm3r

Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

LOW 36

A session fixation vulnerability was found in Keycloak's login-actions endpoints.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00836 Published 2026-05-19 Fixed in 26.2.16-1, 26.2-21 +7 CWE-290

TI-2026-36952 CVE-2026-50193 · GHSA-3wrr-7qpf-2prh

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

LOW 35

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00616 Published 2026-06-23 Partial fix · 2.14.0 CWE-400

TI-2026-04899 CVE-2026-5588 · GHSA-wg6q-6289-32hp

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

LOW 35

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00777 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +4 CWE-327

TI-2026-01746 CVE-2026-2092 · GHSA-794g-x443-36f7

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

LOW 34

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00383 Published 2026-03-18 Fixed in 26.2.14-1, 26.2-16 +7 CWE-1287

TI-2026-02198 CVE-2026-2575 · GHSA-xv6h-r36f-3gp5

Keycloak: keycloak: denial of service due to excessive samlrequest decompression

LOW 31

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00663 Published 2026-03-18 Fixed in 26.4.10-1, 26.4-12 +5 CWE-409