CVE-2025-11419
Keycloak: keycloak tls client-initiated renegotiation denial of service
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Keycloak: keycloak tls client-initiated renegotiation denial of service
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
- Record
CVE-2025-11419- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2025-36356
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
- Record
EUVD-2025-36356- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q8hq-4h99-fj7x
Keycloak TLS Client-Initiated Renegotiation Denial of Service
Keycloak is vulnerable to a Denial of Service (DoS) attack due to the default JDK setting that permits Client-Initiated Renegotiation in TLS 1.2. An unauthenticated remote attacker can repeatedly initiate TLS renegotiation requests to exhaust server CPU resources, making the service unavailable. Immediate mitigation is available by setting the -Djdk.tls.rejectClientInitiatedRenegotiation=true Java system property in the Keycloak startup configuration.
- Record
GHSA-q8hq-4h99-fj7x- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
NVD
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
- Record
CVE-2025-11419- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Keycloak: keycloak tls client-initiated renegotiation denial of service
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
- Record
CVE-2025-11419- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-q8hq-4h99-fj7x
Keycloak TLS Client-Initiated Renegotiation Denial of Service
Keycloak is vulnerable to a Denial of Service (DoS) attack due to the default JDK setting that permits Client-Initiated Renegotiation in TLS 1.2. An unauthenticated remote attacker can repeatedly initiate TLS renegotiation requests to exhaust server CPU resources, making the service unavailable. Immediate mitigation is available by setting the -Djdk.tls.rejectClientInitiatedRenegotiation=true Java system property in the Keycloak startup configuration.
- Record
GHSA-q8hq-4h99-fj7x- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-quarkus-distMaven |
before 26.0.16 | 26.0.16 |
org.keycloak:keycloak-quarkus-distMaven |
26.1.0 up to 26.2.10 | 26.2.10 |
org.keycloak:keycloak-quarkus-distMaven |
26.3.0 up to 26.4.1 | 26.4.1 |
org.keycloak:keycloak-quarkus-distMaven |
before 26.0.16, plus listed versions 17.0.017.0.118.0.018.0.118.0.2 Show 45 moreShow less19.0.019.0.119.0.219.0.320.0.020.0.120.0.220.0.320.0.521.0.021.0.121.0.221.1.021.1.121.1.222.0.022.0.122.0.222.0.322.0.422.0.523.0.023.0.123.0.223.0.323.0.423.0.523.0.623.0.724.0.024.0.124.0.224.0.324.0.424.0.525.0.025.0.125.0.225.0.325.0.425.0.525.0.626.0.026.0.126.0.2 |
26.0.16 |
org.keycloak:keycloak-quarkus-distMaven |
26.1.0 up to 26.2.10, plus listed versions 26.1.126.1.226.1.326.1.426.1.5 Show 6 moreShow less26.2.026.2.126.2.226.2.326.2.426.2.5 |
26.2.10 |
org.keycloak:keycloak-quarkus-distMaven |
26.3.0 up to 26.4.1, plus listed versions 26.3.126.3.226.3.326.3.426.3.526.4.0 |
26.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-11419 is a high vulnerability (CVSS 7.5) in Red Hat Build Of Keycloak 26.0, published October 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in org.keycloak:keycloak-quarkus-dist 26.0.16.
References
access.redhat.com/errata/RHSA-2025:18254
bugzilla.redhat.com/show_bug.cgi?id=2402142
Show 9 moreShow less
github.com/keycloak/keycloak/discussions/25209
nvd.nist.gov/vuln/detail/CVE-2025-11419
catalog.redhat.com/software/containers
Left out here: 5 versions. The JSON record has them.