Red Hat Build Of Keycloak vulnerabilities

86 CVEs affecting Red Hat Build Of Keycloak, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-109082, published 2026-10-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-5685, published 2024-03-22. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management…
CVE-2024-5971, published 2024-07-08. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not…
CVE-2024-3656, published 2024-10-09. High severity, CVSS 8.1. EPSS: 2.9% chance of exploitation in the next 30 days. A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for…
CVE-2026-93567, published 2026-09-18. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for…
CVE-2026-93569, published 2026-09-18. High severity, CVSS 8.2. EPSS: 2.2% chance of exploitation in the next 30 days. A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form…
CVE-2024-8698, published 2024-09-19. High severity, CVSS 7.7. EPSS: 2% chance of exploitation in the next 30 days. A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for…
CVE-2024-3653, published 2024-07-08. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler…
CVE-2024-6162, published 2024-06-20. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode…
CVE-2024-1023, published 2024-03-27. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to…
CVE-2024-3884, published 2025-12-03. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding…

Latest

CVE-2026-109082, published 2026-10-12. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where…
CVE-2026-107889, published 2026-10-09. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator…
CVE-2026-107623, published 2026-10-08. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted…
CVE-2026-107604, published 2026-10-08. Medium severity, CVSS 4.9. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access…
CVE-2026-107121, published 2026-10-07. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing…
CVE-2026-105305, published 2026-10-06. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security…
CVE-2026-105306, published 2026-10-05. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive…
CVE-2026-105302, published 2026-10-05. Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note…
CVE-2026-105301, published 2026-10-05. Medium severity, CVSS 4.0. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate…
CVE-2026-103884, published 2026-10-01. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client…