Red Hat Single Sign-On 7.

Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Fuse 7
• Other injection

Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• Authentication bypass

Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

• Red Hat Build of Apache Camel 3.33.3.SP2
• Red Hat Build of Debezium 3.6
• HTTP request smuggling

Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

• Red Hat Build of Apache Camel 3.33.3.SP2
• Red Hat Build of Debezium 3.6
• CWE-20

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• Denial of service

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

• Red Hat Build of Debezium 3.6
• Red Hat build of Quarkus 3.27.5.SP2
• CWE-1035

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

• Red Hat Build of Apache Camel 3.33.3.SP2
• Red Hat Build of Debezium 3.6
• CWE-1035

Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)

• Red Hat Build of Apache Camel 3.33.3.SP2
• Red Hat Build of Debezium 3.6
• CWE-1035

Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

• Red Hat Build of Apache Camel 3.33.3.SP2
• Red Hat Build of Debezium 3.6
• CWE-1035

Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Fuse 7
• CWE-1035

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

• Red Hat Build of Debezium 3.6
• Red Hat build of Quarkus 3.27.5.SP2
• CWE-1035

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

• Red Hat Build of Apache Camel 3.33.3.SP2
• Red Hat Build of Debezium 3.6
• Denial of service

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

• Red Hat Build of Apache Camel 3.33.3.SP2
• Red Hat Build of Debezium 3.6
• Denial of service

Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Fuse 7
• CWE-1035

Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Fuse 7
• Denial of service

Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder

• Red Hat AMQ Broker 7
• Red Hat build of Apache Camel for Spring Boot 4
• CWE-1035

Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Fuse 7
• CWE-1035

Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Fuse 7
• CWE-1035

Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.16
• Authentication bypass

Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.16
• Broken access control

Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.16
• Denial of service

Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.16
• Broken access control

Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.16
• Denial of service

Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Authentication bypass

Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Information disclosure

Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Authentication bypass

Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.16
• Path traversal

Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Broken access control

Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 10
• Denial of service

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• Denial of service

Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

• Red Hat Build of Apache Camel 3.33.3.SP2
• Red Hat Build of Debezium 3.6
• CWE-173

Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

• Red Hat JBoss Web Server 7.0.3
• Red Hat JBoss Web Server 7.0 on RHEL 10
• Memory corruption

Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.6
• CWE-341

Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Broken access control

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 10
• CWE-681

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• HTTP request smuggling

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

• Red Hat JBoss Enterprise Application Platform 7.4.25
• Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
• Denial of service

Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

• Red Hat JBoss Enterprise Application Platform 7.4.25
• Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
• Memory corruption

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

• Red Hat Fuse 7
• Red Hat JBoss Enterprise Application Platform 7
• Unrestricted file upload

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

• Red Hat Fuse 7
• Red Hat JBoss Enterprise Application Platform 7
• Other injection

Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow

• Red Hat Build of Keycloak
• Red Hat JBoss Enterprise Application Platform Expansion Pack
• Authentication bypass

Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• CWE-346

Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.5
• Denial of service

Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Other injection
• Privilege escalation

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Broken access control
• CWE-551

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• CWE-178
• CWE-551

Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Weak cryptography or TLS

Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• Weak cryptography or TLS

Wildfly-core: path traversal on wildfly domain controller

• Red Hat JBoss Enterprise Application Platform 7
• Red Hat JBoss Enterprise Application Platform 8
• Path traversal

Keycloak-services: keycloak-services: client access-type policy condition bypass during client update

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• CWE-1288

Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-20

Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• Broken access control

Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-20

Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• Broken access control