CVE-2017-2585: Red Hat Keycloak

Medium severity, CVSS 5.9. EPSS: 2% chance of exploitation in the next 30 days.

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

Affected products

• Red Hat Keycloak: before 2.5.1 (fixed in 2.5.1)
• Red Hat Single Sign On: version 7.1 only; version 7.2 only

Published 2018-03-12. Last modified 2026-06-17.