Red Hat Red Hat Build Of Keycloak
179 CVEs affecting Red Hat Red Hat Build Of Keycloak. Latest disclosed: 2026-09-28. Critical: 1, High: 47.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18963 | Critical | 9.1 | 2026-08-18 | A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build… |
CVE-2026-15572 | High | 8.8 | 2026-08-05 | A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which… |
CVE-2026-93569 | High | 8.2 | 2026-09-18 | A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request… |
CVE-2025-3501 | High | 8.2 | 2025-04-29 | A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended. |
CVE-2026-74909 | High | 8.1 | 2026-09-16 | Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enf… |
CVE-2026-16102 | High | 8.1 | 2026-08-05 | A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to pr… |
CVE-2026-15573 | High | 8.1 | 2026-08-05 | A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properl… |
CVE-2026-11800 | High | 8.1 | 2026-06-25 | A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials t… |
CVE-2026-9800 | High | 8.1 | 2026-06-25 | A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and… |
CVE-2026-7504 | High | 8.1 | 2026-05-19 | A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirec… |
CVE-2025-23368 | High | 8.1 | 2025-03-04 | A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within… |
CVE-2024-3656 | High | 8.1 | 2024-10-09 | A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allo… |
CVE-2026-9099 | High | 7.7 | 2026-06-25 | A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user wit… |
CVE-2024-8698 | High | 7.7 | 2024-09-19 | A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is… |
CVE-2023-6563 | High | 7.7 | 2023-12-14 | An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500… |
CVE-2026-93568 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's… |
CVE-2026-93567 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONN… |
CVE-2026-93565 | High | 7.5 | 2026-09-18 | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming… |
CVE-2026-93564 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted P… |
CVE-2026-93558 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to… |