The Red Hat build of Keycloak 24.0.9, a standalone authentication and single sign-on server, contains several security vulnerabilities. Among these is CVE-2024-9666, a denial-of-service vulnerability related to proxy header handling. Additional vulnerabilities addressed include sensitive data exposure during the build process (CVE-2024-10451), path traversal (CVE-2024-10492), other denial-of-service issues (CVE-2024-10270), and TLS passthrough concerns (CVE-2024-10039). Red Hat has issued an important security advisory (RHSA-2024:10176) providing updated packages to remediate these issues. Users are advised to back up their environments before applying the update.

The vulnerabilities collectively could allow attackers to cause denial-of-service conditions, potentially disrupting authentication services, and expose sensitive data during the build process. Path traversal could enable unauthorized access to files. These impacts affect the confidentiality, integrity, and availability of the Keycloak service. No evidence of active exploitation has been reported.

Red Hat has released updated packages for Red Hat build of Keycloak 24.0.9 that address these vulnerabilities. Users should back up their existing installations, including configurations and databases, before applying the update. Applying the official Red Hat update is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigations are specified or required beyond applying the update.