Red Hat Product Errata RHSA-2026:95759 - Security Advisory
Issued:
2026-11-06
Updated:
2026-11-06

RHSA-2026:95759 - Security Advisory

Synopsis

Important: Red Hat build of Keycloak 26.4.17 Security Update

Type/Severity

Security Advisory: Important

Topic

New Red Hat build of Keycloak 26.4.17 packages are available from the Customer Portal

Description

Red Hat build of Keycloak 26.4.17 is a standalone server, based on
the Keycloak project, that provides authentication and
standards-based single sign-on capabilities for web and mobile
applications.

Security fixes:

  • Account takeover via authentication race using reset-credentials path (CVE-2026-103112)
  • Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602)
  • PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879)
  • Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931)
  • UMA Protection API resourceType field not validated — cross-owner resource access (CVE-2026-114232)
  • Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)
  • Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506)
  • SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217)
  • Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611)
  • Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)
  • Information disclosure via CORS Vary header overwrite (CVE-2026-59903)
  • SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)
  • SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874)
  • Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965)
  • Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763)
  • SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855)
  • DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857)
  • Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488)
  • Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491)
  • HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492)
  • Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558)
  • Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562)
  • HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564)
  • Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565)
  • HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566)
  • HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567)
  • HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568)
  • HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569)
  • Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573)
  • HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574)
  • HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579)
  • SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998)
  • kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453)
  • DCR registration-time claim-path gap allows forging realm_access.roles (CVE-2026-96547)
  • Unverified IdP email auto-linking enables account takeover (CVE-2026-97175)
  • DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367)
  • Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847)
  • Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)

Solution

Before applying the update, back up your existing installation,
including all applications, configuration files, databases and
database settings, and so on.

Affected Products

  • Red Hat build of Keycloak Text-only Advisories x86_64

Fixes

(none)

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.