Red Hat Security Advisory: Red Hat build of Keycloak 26.2.10 Security Update

The Red Hat build of Keycloak 26.2.10 contains a security vulnerability identified as CVE-2025-11419, which is a denial of service (DoS) flaw triggered by TLS client-initiated renegotiation. This vulnerability is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). The issue affects the standalone Keycloak server used for authentication and single sign-on capabilities. Red Hat has released an updated package (version 26.2.10) that includes a fix for this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to cause a denial of service condition on the Keycloak server by abusing TLS client-initiated renegotiation, potentially disrupting authentication services for web and mobile applications relying on Keycloak.

Red Hat has released an updated package for Keycloak 26.2.10 that addresses this vulnerability. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official Red Hat update is the recommended mitigation. No other specific mitigations or workarounds are provided in the advisory.