Red Hat Red Hat Build of Keycloak

• CVE-2026-93562 Medium 6.5 Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling 0.4%
• CVE-2026-93574 Medium 6.5 Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing 1.4%
• CVE-2026-93432 Medium 6.1 Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus 1.2%
• CVE-2026-93579 Medium 6.5 Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough) 0.9%
• CVE-2026-93573 Medium 6.5 Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling 0.9%
• CVE-2026-93568 High 7.5 Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests 1.0%
• CVE-2026-93569 High 8.2 Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority 2.2%
• CVE-2026-93567 High 7.5 Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority 2.6%
• CVE-2026-93566 Medium 6.5 Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line 0.5%
• CVE-2026-93565 High 7.5 Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte 0.8%
• CVE-2026-93564 High 7.5 Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881) 0.9%
• CVE-2026-93558 High 7.5 Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service 1.1%
• CVE-2026-93492 Medium 5.3 Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size 0.4%
• CVE-2026-93491 High 7.5 Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue 0.7%
• CVE-2026-93488 High 7.5 Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams 0.8%
• CVE-2026-87743 High 7.5 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security 0.5%
• CVE-2026-89058 High 7.4 Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config 0.5%
• CVE-2026-89059 High 7.5 Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) 1.5%
• CVE-2026-90997 High 7.4 Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch 0.4%
• CVE-2026-92358 Medium 6.4 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking 0.3%
• CVE-2026-89298 Medium 4.9 Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get 0.4%
• CVE-2026-88770 Medium 6.5 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts 0.4%
• CVE-2026-82968 Medium 6.4 Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers 0.3%
• CVE-2026-19611 High 7.4 Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding 0.9%
• CVE-2026-19608 Medium 5.3 Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies 0.3%
• CVE-2026-18967 Medium 6.4 Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow 0.2%
• CVE-2026-18203 Medium 6.5 Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes 0.3%
• CVE-2026-18211 Medium 4.2 Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains 0.3%
• CVE-2026-18208 Medium 6.5 Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim 0.3%
• CVE-2026-18217 Low 3.4 Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution 0.4%
• CVE-2026-18207 Medium 6.5 Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching 0.3%
• CVE-2026-17048 Medium 5.5 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api 0.4%
• CVE-2026-16103 Medium 4.3 Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption 0.3%
• CVE-2026-15943 Medium 5.5 Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change 0.3%
• CVE-2026-14781 Medium 4.8 Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email 0.3%
• CVE-2026-14614 Medium 5.4 Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource 0.3%
• CVE-2026-14613 Medium 4.3 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission 0.4%
• CVE-2026-12388 Medium 6.5 Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper 0.4%
• CVE-2026-11800 High 8.1 Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion 0.3%
• CVE-2026-9796 Medium 6.5 Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability 0.2%
• CVE-2026-37980 Medium 6.9 Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page 0.4%
• CVE-2026-4874 Low 3.1 Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation 0.4%
• CVE-2026-4633 Low 3.7 Keycloak: keycloak: user enumeration via differential error messages 0.4%
• CVE-2026-4628 Medium 4.3 Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control 0.3%
• CVE-2026-4366 Medium 5.8 Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak 0.2%
• CVE-2026-3429 Medium 4.2 Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api 0.3%
• CVE-2026-2733 Low 3.8 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol 0.4%
• CVE-2025-11537 Medium 5.0 Keycloak-services: sensitive headers shown in the http access logs 0.2%
• CVE-2026-1180 Medium 5.8 Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri 0.4%
• CVE-2026-0976 Low 3.7 Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths 0.5%