rhsa-2025:18889
Vulnerability from csaf_redhat
Published
2025-10-21 17:09
Modified
2025-11-07 18:35
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.2.10 Images Security Update
Notes
Topic
New images are available for Red Hat build of Keycloak 26.2.10 and Red Hat build of Keycloak 26.2.10 Operator, running on OpenShift Container Platform
Details
Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.
Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.2.10 clusters.
This erratum releases new images for Red Hat build of Keycloak 26.2.10 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.
Security fixes:
* Keycloak TLS Client-Initiated Renegotiation Denial of Service (CVE-2025-11419)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New images are available for Red Hat build of Keycloak 26.2.10 and Red Hat build of Keycloak 26.2.10 Operator, running on OpenShift Container Platform",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\nRed Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.2.10 clusters.\nThis erratum releases new images for Red Hat build of Keycloak 26.2.10 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* Keycloak TLS Client-Initiated Renegotiation Denial of Service (CVE-2025-11419)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:18889",
"url": "https://access.redhat.com/errata/RHSA-2025:18889"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_18889.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.2.10 Images Security Update",
"tracking": {
"current_release_date": "2025-11-07T18:35:57+00:00",
"generator": {
"date": "2025-11-07T18:35:57+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2025:18889",
"initial_release_date": "2025-10-21T17:09:36+00:00",
"revision_history": [
{
"date": "2025-10-21T17:09:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-21T17:09:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-07T18:35:57+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Keycloak 26.2",
"product": {
"name": "Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:build_keycloak:26.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Keycloak"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64",
"product_id": "rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.2-11"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64",
"product": {
"name": "rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64",
"product_id": "rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=26.2.10-2"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.2-11"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64",
"product_id": "rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.2-11"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.2-11"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x",
"product_id": "rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.2-11"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.2-11"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le",
"product_id": "rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.2-11"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.2-11"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64 as a component of Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64"
},
"product_reference": "rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64",
"relates_to_product_reference": "9Base-RHBK-26.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x as a component of Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x",
"relates_to_product_reference": "9Base-RHBK-26.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le as a component of Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le",
"relates_to_product_reference": "9Base-RHBK-26.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64 as a component of Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64",
"relates_to_product_reference": "9Base-RHBK-26.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64 as a component of Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64",
"relates_to_product_reference": "9Base-RHBK-26.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x as a component of Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x",
"relates_to_product_reference": "9Base-RHBK-26.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64 as a component of Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64",
"relates_to_product_reference": "9Base-RHBK-26.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64 as a component of Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64",
"relates_to_product_reference": "9Base-RHBK-26.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le as a component of Red Hat build of Keycloak 26.2",
"product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le",
"relates_to_product_reference": "9Base-RHBK-26.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11419",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-10-07T11:12:36.431000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2402142"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak: Keycloak TLS Client-Initiated Renegotiation Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11419"
},
{
"category": "external",
"summary": "RHBZ#2402142",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402142"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11419"
}
],
"release_date": "2025-10-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-21T17:09:36+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
"product_ids": [
"9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:18889"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, configure Keycloak to reject client-initiated TLS renegotiation by adding the following Java system property to the Keycloak startup configuration:\n-Djdk.tls.rejectClientInitiatedRenegotiation=true\n\nThis prevents unauthenticated attackers from triggering repeated TLS renegotiations and exhausting server CPU resources.\nAdditionally, ensure that Keycloak is deployed behind proper network access controls and rate-limiting mechanisms to further reduce exposure to DoS attacks.",
"product_ids": [
"9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:4799ddae8374f34fb57fa7a27f5248f02420b808ef1c62042fa4315cc88f0dfb_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:087a5a887392ed14b858d87b92fe46abb5c49c8bae96fe78abcf0767fd20f0ed_s390x",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:3ea74e7e42176115fcda6831ab8c70ab21975b42b5d0d3f8e60114396e992420_ppc64le",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:95132189f2539f5c80beb8293acfe858e62cebdc1824aa86d54f56a9183d5469_arm64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:9d0f6631fb91d3c4019b8cb724ecb3c23f8ea37224b1878cb83df9b855ce469f_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:79da0f754d37d8e30f747dcd965d3257ccbccfc40b24e2d60528b160d92a4d68_s390x",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:841e97f39fade3aadba63173ab240617be5d45248ebd62891883e719e75a89d7_arm64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:a9cd6589d4ef0b3eabd938a17b1caf29b5b037cf55590175c9c1800820dcd3e4_amd64",
"9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:d176b6ea43ccbb1d8fe480bf8674217d52b661667da2d1df1516a94347c2e764_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak: Keycloak TLS Client-Initiated Renegotiation Denial of Service"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…