The Red Hat build of Keycloak 26.0.6, a standalone authentication and single sign-on server, contains multiple security vulnerabilities. Among these is CVE-2024-9666, a denial-of-service vulnerability related to proxy header handling. Additional vulnerabilities fixed in this update include sensitive data exposure during the build process (CVE-2024-10451), path traversal (CVE-2024-10492), TLS passthrough issues (CVE-2024-10039), and other denial-of-service vulnerabilities (CVE-2024-10270). Red Hat has issued updated packages addressing these issues, classified as important security fixes. The advisory references multiple bugzilla entries and provides guidance to apply the update after prior errata are installed.

The vulnerabilities collectively could allow attackers to cause denial-of-service conditions, expose sensitive data, and exploit path traversal and TLS passthrough weaknesses in the Red Hat build of Keycloak 26.0.6. These issues impact the security and availability of authentication and single sign-on services provided by Keycloak. No known exploits in the wild have been reported at this time. The severity is assessed as high due to the potential impact on authentication infrastructure.

Red Hat has released updated packages for the Red Hat build of Keycloak 26.0.6 that address these vulnerabilities. Users should apply this update promptly after ensuring all previously released relevant errata are installed. Detailed update instructions are available on the Red Hat Customer Portal. No additional mitigation steps are indicated beyond applying the official update.