Advisories · Technology
Red Hat Build of Keycloak.
Every CVE that names Red Hat Build of Keycloak among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
- Red Hat Build of Debezium 3.6
- Red Hat build of Quarkus 3.27.5.SP2
- CWE-1035
- CVSS 7.5 High
Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- CWE-1035
- CVSS 7.5 High
Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- CWE-1035
- CVSS 7.5 High
Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- CWE-1035
- CVSS 5.3 Medium
Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size
- Red Hat Build of Debezium 3.6
- Red Hat build of Quarkus 3.27.5.SP2
- CWE-1035
- CVSS 7.5 High
Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- Denial of service
- CVSS 7.5 High
Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- Denial of service
- CVSS 7.5 High
Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
- Red Hat build of Quarkus 3.27.5.SP2
- Red Hat build of Quarkus 3.33.3.SP2
- CWE-551
- CVSS 7.4 High
Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
- Red Hat
- Red Hat Build of Apache Camel 3.33.4.redhat
- CWE-346
- CWE-942
- CVSS 7.5 High
Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
- Red Hat
- Red Hat Build of Apache Camel 3.33.4.redhat
- CWE-409
- CVSS 7.4 High
Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch
- Keycloak
- Red Hat Build of Keycloak
- Authentication bypass
- CVSS 6.4 Medium
Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Authentication bypass
- CVSS 4.9 Medium
Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Information disclosure
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Authentication bypass
- CVSS 6.4 Medium
Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Broken access control
- CVSS 7.4 High
Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- CWE-173
- CVSS 5.3 Medium
Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Broken access control
- CVSS 6.4 Medium
Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Authentication bypass
- CVSS 3.7 Low
Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Weak cryptography or TLS
- CVSS 3.7 Low
Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- CWE-20
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Broken access control
- CVSS 4.2 Medium
Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- CWE-20
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Broken access control
- CVSS 3.4 Low
Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- CWE-20
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Broken access control
- CVSS 5.5 Medium
Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.6
- Information disclosure
- CVSS 4.3 Medium
Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- CWE-305
- CWE-841
- CVSS 5.5 Medium
Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- CWE-1288
- CVSS 4.8 Medium
Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- CWE-1288
- CVSS 5.4 Medium
Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.14
- Broken access control
- CVSS 4.3 Medium
Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.6
- Broken access control
- CWE-1220
- CVSS 6.5 Medium
Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper
- Red Hat Build of Keycloak
- Privilege escalation
- CVSS 5.8 Medium
Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.12
- Server-side request forgery (SSRF)
- CVSS 2.7 Low
Keycloak-core: keycloak environment information
- Red Hat Build of Keycloak
- Information disclosure
- CVSS 6.1 Medium
Wildfly: wildfly vulnerable to cross-site scripting (xss)
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
- Cross-site scripting (XSS)