Skip to contentRed Hat Keycloak vulnerabilities
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 moreNetty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionCVE-2026-48059Fix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 morenetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionCVE-2026-48043Fix available5.3 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty has Insufficient Bailiwick Validation for NS RecordsCVE-2026-47691Fix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsCVE-2026-45674Public exploitFix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesCVE-2026-45416Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +23 more +25 moreNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthCVE-2026-44893Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingCVE-2026-44249Fix available8.1 High
- netty, io.netty netty-codec-http, netty-codec-http2 +37 more +39 moreNetty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSCVE-2026-42587Fix available7.5 High
- netty, io.netty netty-codec-http, red hat cryostat 4 on rhel 9 +33 more +35 moreNetty: HttpClientCodec response desynchronizationCVE-2026-42584Fix available7.3 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationCVE-2026-42581Fix available5.8 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)CVE-2026-42579Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP Header Injection via HttpProxyHandler Disabled ValidationCVE-2026-42578Fix available2.9 Low
- netty, red hat cryostat 4, cryostat 4 on rhel 9 +37 more +39 moreNetty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassCVE-2026-33871Public exploitFix available8.7 High
- netty, red hat cryostat 4 on rhel 9, logging subsystem for red hat openshift +33 more +35 moreNetty: HTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-33870Fix available7.5 High
- redhat keycloak, red hat keycloak-services +1 moreCross-site Scripting in KeycloakCVE-2021-20323Public exploitFix availableEPSS 37.2%6.1 Medium
- keycloakPath TraversalCVE-2020-14366Fix available6.8 Medium
- keycloak, redhat openstack +1 moreImproper Certificate Validation and Improper Validation of Certificate with Host Mismatch in KeycloakCVE-2020-1758Fix available5.3 Medium
- keycloak, quarkus, redhat decision manager +4 more +6 moreImproper Input Validation in KeycloakCVE-2020-1714Fix available7.5 High
- keycloak, redhat jboss fuse, openshift application runtimes +2 moreImproper Authentication for KeycloakCVE-2020-1718Fix available7.1 High
- keycloak, redhat openshift application runtimes, single sign-on +2 moreKeycloak Insufficient Session ExpiryCVE-2020-1724Fix available4.3 Medium
- keycloakKeycloak leaks sensitive information in logged exceptionsCVE-2020-1698Fix available5.0 Medium
- keycloakExposure of Sensitive Information in keycloakCVE-2020-1744Fix available5.6 Medium
- keycloak, redhat keycloak operator +1 morePredictable password in KeycloakCVE-2020-1731Fix available9.1 Critical
- keycloak, redhat single sign-on +1 moreXSS in KeycloakCVE-2020-1697Fix available6.1 Medium
- keycloak, redhat single sign-on +1 morekeycloak vulnerable to unauthorized login via mail server setupCVE-2019-14837Fix available9.1 Critical
- keycloak, redhat single sign-on +1 moreImproper Verification of Cryptographic Signature in keycloakCVE-2019-10201Fix available8.1 High
- keycloakImproper Input Validation and Cross-Site Request Forgery in KeycloakCVE-2019-10199Fix available4.6 Medium
- keycloak, redhat single sign-on +1 moreImproper Certificate Validation and Insufficient Verification of Data Authenticity in KeycloakCVE-2019-38756.5 Medium
- keycloak, redhat single sign-on +1 moreForced Logout in keycloak-connectCVE-2019-10157Fix available4.7 Medium
- keycloakExposure of Sensitive Information to an Unauthorized Actor in KeycloakCVE-2019-3868Fix available3.8 Low
- keycloakKeycloak Open RedirectCVE-2018-146586.1 Medium
- keycloak, redhat single sign-on +1 moreKeycloak Improper Bruteforce DetectionCVE-2018-14657Fix available5.4 Medium
- keycloak, redhat single sign-on +1 moreKeycloak vulnerable to cross-site scripting via the state parameterCVE-2018-146554.6 Medium
- keycloak, redhat single sign-on +1 moreKeycloak Authentication ErrorCVE-2018-10894Fix available5.4 Medium
- keycloakImproper Authentication in org.keycloak:keycloak-coreCVE-2016-8609Fix available3.7 Low
- keycloakKeycloak vulnerable to infinite loop based Denial of ServiceCVE-2017-2646Fix available7.5 High
- keycloak, redhat jboss enterprise application platform +1 morekeycloak-core discloses system propertiesCVE-2017-2582Fix available6.5 Medium