The vulnerability CVE-2024-11734 affects Keycloak and involves a protection mechanism failure where an administrative user can cause a denial of service by modifying security headers with newline characters. This causes the Keycloak server to attempt writing to a request that has already been terminated, resulting in the failure of that request. The issue requires administrative privileges to change realm settings. Red Hat has issued security advisories and released updated Keycloak 26.0.8 images that fix this vulnerability.

An administrative user with the ability to change realm settings can disrupt the Keycloak service by triggering a denial of service condition. This does not impact confidentiality or integrity but results in availability loss of the service. There are no known exploits in the wild at this time.

Red Hat has released fixed versions of Keycloak (26.0.8) that address this vulnerability. Users should apply the update to these versions as soon as possible. The vendor advisory provides detailed instructions for applying the update. No additional mitigation is required beyond applying the official fix.