Threat database

A security vulnerability has been identified in Keycloak related to the PostgreSQL JDBC Driver (pgjdbc) versions 42. The affected Keycloak versions are those prior to 26.8.1-r1. The vulnerability has a medium severity with a CVSS score of 5.9 and impacts confidentiality without affecting integrity or availability. A patch is available in version 26.8.1-r1.

A medium severity vulnerability affects Keycloak versions prior to 26.8.1-r1 related to the opentelemetry-java component, which implements the OpenTelemetry API and SDK for telemetry recording and management. The vulnerability impacts availability but does not affect confidentiality or integrity. A patch is available in version 26.8.1-r1.

A security vulnerability exists in Keycloak versions prior to 26.8.1-r1 related to the MariaDB Connector/J used for Java applications connecting to MariaDB and MySQL databases. The vulnerability has a medium severity with a CVSS score of 5.9 and impacts the integrity of the system without affecting confidentiality or availability. A patch is available in version 26.8.1-r1 to address this issue.

A low-severity security vulnerability exists in Keycloak versions prior to 26.8.1-r1 related to the use of MariaDB Connector/J for Java applications connecting to MariaDB and MySQL databases. The vulnerability does not impact confidentiality or integrity but may cause a limited availability impact. A fix is available in version 26.8.1-r1.

A security vulnerability exists in the Keycloak package affecting versions prior to 26.8.1-r1. The issue involves the MariaDB Connector/J used for connecting Java applications to MariaDB and MySQL databases. The vulnerability has a CVSS score of 5.9, indicating a medium severity level, and impacts availability without affecting confidentiality or integrity. A patch is available in version 26.8.1-r1 to address this issue.

A security vulnerability exists in the Keycloak package related to the MariaDB Connector/J used for Java applications connecting to MariaDB and MySQL databases. The vulnerability affects versions prior to 26.8.1-r1 and has a CVSS score of 5.9, indicating medium severity. A fix is available in version 26.8.1-r1.

A security vulnerability identified as CVE-2026-102477 affects the Keycloak package within Eclipse Vert. The vulnerability impacts versions prior to 26.8.1-r1 and has a CVSS score of 5.9, indicating a medium severity level. The flaw does not affect confidentiality or integrity but has an impact on availability. A patch is available in version 26.8.1-r1.

A security vulnerability identified as CVE-2026-102467 affects the Keycloak package within Eclipse Vert. The vulnerability has a CVSS score of 5.9, indicating a medium severity level. It impacts availability but does not affect confidentiality or integrity. Versions of Keycloak prior to 26.8.1-r1 are affected. A patch is available in version 26.8.1-r1.

A security vulnerability identified as CVE-2026-102460 affects the Keycloak package integrated with Eclipse Vert. The vulnerability impacts versions of Keycloak prior to 26.8.1-r1 and has a CVSS score of 5.9, indicating a medium severity level. The flaw does not affect confidentiality or integrity but results in a high impact on availability. A patch is available in version 26.8.1-r1 to address this issue.

A high-severity vulnerability in Keycloak versions prior to 26.8.1-r1 involves uncontrolled allocation of resources during Java object deserialization in Google Guava versions 4. This flaw can lead to resource exhaustion without limits or throttling, potentially impacting availability. The issue is tracked as CVE-2026-102554 and has a CVSS 4.0 base score of 8.2. A fix is available in Keycloak version 26.8.1-r1.

A critical security vulnerability in Keycloak involves the jackson-databind library improperly validating the outer class of a class-name type ID while accepting attacker-controlled classes inside generic arguments. This flaw allows an attacker to bypass type restrictions, potentially leading to severe impacts on confidentiality, integrity, and availability. The vulnerability affects Keycloak versions prior to 26.8.1-r1 and has a CVSS score of 9.8. A fix is available in version 26.8.1-r1.

A critical buffer overflow vulnerability exists in the Brotli decoder component of Keycloak, identified as CVE-2026-111497. This flaw affects Keycloak versions prior to 26.8.1-r1 and can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability has a high CVSS score of 9.8, indicating severe impact if exploited. A fix is available in version 26.8.1-r1.

A security vulnerability exists in the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. This vulnerability affects Keycloak versions prior to 26.8.1-r1. The flaw has a medium severity with a CVSS score of 5.3. A fix is available in version 26.8.1-r1.

A security vulnerability exists in the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. This vulnerability affects Keycloak versions prior to 26.8.1-r1. The flaw has a medium severity with a CVSS score of 5.3. A fix is available in version 26.8.1-r1.

A high-severity security vulnerability (CVE-2026-17507) affects Keycloak due to an issue in the Bouncy Castle for Java library versions before 26.8.1-r1. The vulnerability does not impact confidentiality or integrity but causes a denial of service (availability impact). A fix is available in version 26.8.1-r1.

A security vulnerability exists in the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. The vulnerability affects Keycloak versions prior to 26.8.1-r1 and has a medium severity rating with a CVSS score of 5.9. A fix is available in version 26.8.1-r1.

A high-severity security vulnerability (CVE-2026-18036) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.8.1-r1. The vulnerability has a CVSS 4.0 score of 8.2, indicating significant impact. A fix is available in version 26.8.1-r1.

A security vulnerability exists in the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. This vulnerability affects Keycloak versions prior to 26.8.1-r1. The flaw has a CVSS 4.0 base score of 6.9, indicating a medium severity level. A fix has been released in version 26.8.1-r1.

A high-severity security vulnerability (CVE-2026-71891) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.8.1-r1. The vulnerability has a CVSS 4.0 base score of 7.1. A fix is available in version 26.8.1-r1.

CVE-2026-71890 is a high-severity security vulnerability affecting the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.8.1-r1. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant risk. A fix is available in version 26.8.1-r1.