RHSA-2026:95762

A flaw was found in Netty's WebSocketServerExtensionHandler.

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID.

TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID.

A flaw was found in Netty's HTTP/1 decoder.

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type…

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI.

A flaw was found in Netty.

A flaw was found in Netty's HTTP/2 codec.

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names.

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard.

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection.

A flaw was found in Netty.

A flaw was found in Netty.

A flaw was found in Netty's HttpServerCodec.

A flaw was found in Netty.

Netty is an asynchronous, event-driven network application framework.

A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution.

A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution.

A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution.

A flaw was found in Netty RtspDecoder.

A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation.

A flaw was found in the UserManagedPermissionService of the Keycloak authorization server.

A flaw was found in Netty's HTTP/2 stack.

A flaw was found in Netty's HTTP/1.1 decoder.

In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path.

A flaw was found in the Organization identity-first login flow of the Keycloak authentication server.

A flaw was found in Netty.

A flaw was found in WildFly Elytron.

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications.

A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line.

A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication.

A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management.

A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution.

A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers.

A flaw was found in the authentication session handling of the keycloak-services component in Keycloak.

Netty is an asynchronous, event-driven network application framework.

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution.

A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak.

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution.

A flaw was found in Netty's `netty-codec-http` component.

A flaw was found in the protocol mapper and identity resolution components of Keycloak.

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate.

A flaw was found in the user update mechanism of the Keycloak Admin REST API.

A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution.

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution.

A flaw was found in Netty's HTTP/2 HpackEncoder.

A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users.

A flaw was found in Keycloak.

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution.

A flaw was found in the first broker login flow of Keycloak.

A flaw was found in the first-broker-login flow of the Keycloak identity management service.

A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak.

A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution.

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution.

A flaw was found in the X.509 client certificate authenticator of Keycloak.

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution.

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component.

A flaw was found in the client policy enforcement mechanism of Keycloak.

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution.

A flaw was found in the SMTP email configuration handling of the keycloak-services component.

A flaw was found in the login theme rendering component of Keycloak.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution.

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers.

A flaw was found in the token exchange mechanism of Keycloak.

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow.

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources.

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution.

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution.

A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution.

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution.

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution.

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak.

A flaw was found in the keycloak-services component of Keycloak.

A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution.

A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak.

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution.

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management.

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak.

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak.

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services.

A flaw was found in the authentication session management of Keycloak, an identity and access management solution.