RHSA-2026:95759

A flaw was found in Netty's WebSocketServerExtensionHandler.

A flaw was found in Netty's HTTP/1 decoder.

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type…

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI.

A flaw was found in Netty.

A flaw was found in Netty's HTTP/2 codec.

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names.

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard.

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection.

A flaw was found in Netty.

A flaw was found in Netty.

A flaw was found in Netty's HttpServerCodec.

A flaw was found in Netty.

Netty is an asynchronous, event-driven network application framework.

A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution.

A flaw was found in Netty RtspDecoder.

A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation.

A flaw was found in the UserManagedPermissionService of the Keycloak authorization server.

A flaw was found in Netty's HTTP/2 stack.

A flaw was found in Netty's HTTP/1.1 decoder.

In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path.

A flaw was found in Netty.

A flaw was found in WildFly Elytron.

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications.

A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line.

A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication.

A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management.

A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution.

A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers.

A flaw was found in the authentication session handling of the keycloak-services component in Keycloak.

Netty is an asynchronous, event-driven network application framework.

A flaw was found in Netty's `netty-codec-http` component.

A flaw was found in the protocol mapper and identity resolution components of Keycloak.

A flaw was found in Netty's HTTP/2 HpackEncoder.

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification.

A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution.

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution.

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution.