Skip to contentRed Hat Single Sign-on vulnerabilities
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7 +2 moreKeycloak: impersonation via logout token exchangeCVE-2023-0657Fix available3.4 Low
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.10 +2 more +4 moreKeycloak: session hijacking via re-authenticationCVE-2023-6787Fix available6.5 Medium
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7 +5 more +7 moreKeycloak: log injection during webauthn authentication or registrationCVE-2023-6484Fix available5.3 Medium
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7.6 for rhel 7 +4 more +6 moreKeycloak: authorization bypassCVE-2023-6544Fix available5.4 Medium
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +18 more +20 moreKeycloak: xss via assertion consumer service url in saml post-binding flowCVE-2023-6717Fix available6.0 Medium
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +20 more +22 moreKeycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddosCVE-2024-1249Fix available7.4 High
- redhat keycloak, red hat migration toolkit for runtimes 1 on rhel 8, mta-6.2-rhel-9 +26 more +28 moreKeycloak: path transversal in redirection validationCVE-2024-1132Fix available8.1 High
- red hat build of apache camel - hawtio 4, build of apache camel 4.4.0 for spring boot, build of apache camel for spring boot 3 +15 more +17 moreXnio: stackoverflowexception when the chain of notifier states becomes problematically bigCVE-2023-5685Fix available7.5 High
- redhat keycloak, red hat build of keycloak, single sign-on 7 +2 moreKeycloak-core: dos via account lockoutCVE-2024-1722Fix available3.7 Low
- netapp active iq unified manager, oncommand workflow automation, red hat openshift serverless +35 more +37 moreUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolCVE-2024-1635Fix available7.5 High
- redhat undertow, red hat build of quarkus, data grid 8 +12 more +14 moreUndertow: directory traversal vulnerabilityCVE-2024-1459Fix available5.3 Medium
- redhat keycloak, red hat migration toolkit for applications 6, migration toolkit for applications 7 +21 more +23 moreKeycloak: redirect_uri validation bypassCVE-2023-6291Fix available7.1 High
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.8 +7 more +9 moreKeycloak: open redirect via "form_post.jwt" jarm response modeCVE-2023-6927Fix available4.6 Medium
- infinispan, red hat build of apache camel 4 for quarkus 3, build of apache camel for spring boot 4 +13 more +15 moreInfinispan: circular reference on marshalling leads to dosCVE-2023-5236Fix available4.4 Medium
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.7 +10 more +12 moreKeycloak: reflected xss via wildcard in oidc redirect_uriCVE-2023-6134Fix available4.6 Medium
- redhat keycloak, red hat build of keycloak, single sign-on 7.6 for rhel 7 +8 more +10 moreKeycloak: offline session token dosCVE-2023-6563Fix available7.7 High
- redhat undertow, red hat build of quarkus, data grid 8 +12 more +14 moreUndertow: ajp request closes connection exceeding maxrequestsizeCVE-2023-5379Fix available7.5 High
- red hat single sign-on 7Keycloak: ldap injection on username inputCVE-2022-2232Fix available7.5 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthCVE-2026-50011Public exploitFix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty's wrapping plain trust manager silently disables hostname verificationCVE-2026-50010Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 moreNetty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionCVE-2026-48059Fix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 morenetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionCVE-2026-48043Fix available5.3 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorCVE-2026-48006Fix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty has Insufficient Bailiwick Validation for NS RecordsCVE-2026-47691Fix available8.7 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +8 more +10 moreNetty: SCTP reassembly nests buffers without boundCVE-2026-46340Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsCVE-2026-45674Public exploitFix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesCVE-2026-45416Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +23 more +25 moreNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthCVE-2026-44893Fix available7.5 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty has Unbounded Direct Memory Consumption in its RedisDecoderCVE-2026-44890Fix available7.5 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested ArraysCVE-2026-44250Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingCVE-2026-44249Fix available8.1 High
- netty, io.netty netty-codec-mqtt, red hat amq broker 7.13.6 +8 more +10 moreNetty: Resource exhaustion in MqttDecoderCVE-2026-44248Fix available5.3 Medium
- netty, io.netty netty-codec-http, netty-codec-http2 +37 more +39 moreNetty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSCVE-2026-42587Fix available7.5 High
- netty, io.netty netty-codec-http, red hat cryostat 4 on rhel 9 +33 more +35 moreNetty: HttpClientCodec response desynchronizationCVE-2026-42584Fix available7.3 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationCVE-2026-42581Fix available5.8 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)CVE-2026-42579Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP Header Injection via HttpProxyHandler Disabled ValidationCVE-2026-42578Fix available2.9 Low
- netty, red hat cryostat 4, cryostat 4 on rhel 9 +37 more +39 moreNetty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassCVE-2026-33871Public exploitFix available8.7 High
- netty, red hat cryostat 4 on rhel 9, logging subsystem for red hat openshift +33 more +35 moreNetty: HTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-33870Fix available7.5 High
- redhat undertow, red hat build of quarkus, data grid 8 +25 more +27 moreUndertow: outofmemoryerror due to @multipartconfig handlingCVE-2023-3223Fix available7.5 High
- codehaus-plexus plexus-utils, red hat a-mq clients 2, a-mq online +28 more +30 moreCodehaus-plexus: xml external entity (xxe) injectionCVE-2022-4245Fix available4.3 Medium
- codehaus-plexus plexus-utils, red hat a-mq clients 2, a-mq online +28 more +30 moreCodehaus-plexus: directory traversalCVE-2022-4244Public exploitFix available7.5 High
- redhat single sign-on, red hat single sign-on 7, rhel-8 based middleware containers +4 more +6 moreRhsso-container-image: unsecured management interface exposed to adjecent networkCVE-2022-40398.0 High
- redhat keycloak, red hat single sign-on 7 +1 morePlaintext storage of user passwordCVE-2023-4918Fix available8.8 High
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +5 more +7 moreKeycloak: oauth client impersonationCVE-2023-2422Fix available5.5 Medium
- red hat single sign-on 7, single sign-on 7.6 for rhel 7, single sign-on 7.6 for rhel 8 +7 more +9 moreKeycloak: client access via device auth request spoofCVE-2023-2585Fix available3.5 Low
- redhat undertow, netapp oncommand workflow automation, red hat eap 7.4.10 release +31 more +33 moreUndertow: infinite loop in sslconduit during closeCVE-2023-1108Fix available7.5 High
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +3 more +5 moreKeycloak: reflected xss attackCVE-2022-4137Public exploitFix available8.1 High
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +3 more +5 moreKeycloak: xss on impersonation under specific circumstancesCVE-2022-14386.4 Medium
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +9 more +11 moreKeycloak: session takeover with oidc offline refreshtokensCVE-2022-3916Fix available6.8 Medium
- Show moreLoading…