The Red Hat build of Keycloak 26.0.8 update addresses two security issues: CVE-2024-11734, a denial of service vulnerability related to security headers in the Keycloak server, and CVE-2024-11736, which allows unrestricted administrative use of system and environment variables. These vulnerabilities could impact the stability and security of the authentication server. The update is provided as a security advisory RHSA-2025:0300 by Red Hat Product Security. No CVSS score is provided. The advisory recommends applying the update after prior errata are installed.

The denial of service vulnerability (CVE-2024-11734) could allow an attacker to disrupt the Keycloak server's availability via crafted security headers. The unrestricted admin use of system and environment variables (CVE-2024-11736) could lead to unauthorized administrative actions affecting system configuration or environment settings. Both issues could degrade service reliability or compromise administrative controls within the Keycloak server environment.

Red Hat has released an updated package for the Red Hat build of Keycloak version 26.0.8 that addresses these vulnerabilities. Users should apply this update from the Red Hat Customer Portal after ensuring all previously released errata relevant to their system have been applied. No additional mitigation steps are indicated by the vendor advisory.