Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el8 | rh-sso7-keycloak | 0:18.0.20-1.redhat_00001.1.el8sso |
| Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el8 | rh-sso7-keycloak-server | 0:18.0.20-1.redhat_00001.1.el8sso |
Vulnerabilities 27
-
Critical 9.6
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malici…
-
Critical 9.3
GOSTCTR implementation unable to process more than 255 blocks correctly
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.…
-
High 8.7
Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.…
-
High 8.7CVE-2026-45674 Public exploit
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.…
-
High 8.7
Netty has Insufficient Bailiwick Validation for NS Records
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An atta…
-
High 8.7
Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a synt…
-
High 8.7
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into …
-
High 8.3CVE-2026-0603 Public exploit
Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection
A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. T…
-
High 8.1
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.c…
-
High 8.1CVE-2026-54512 Public exploit
jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…
-
High 7.7
Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by…
-
High 7.5CVE-2025-9784 Public exploit
Undertow: undertow madeyoureset http/2 ddos vulnerability
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeate…
-
High 7.5
Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface:…
-
High 7.5
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is c…
-
High 7.5
Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice…
-
High 7.5
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the firs…
-
High 7.5
Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption …
-
High 7.5
Netty's wrapping plain trust manager silently disables hostname verification
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X…
-
High 7.5
Keycloak: keycloak: denial of service via specially crafted saml input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial …
-
High 7.5
Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /…
-
High 7.4
Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
-
Medium 6.3
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply…
-
Medium 6.3
PKIX draft CompositeVerifier accepts empty signature sequence as valid.
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpk…
-
Medium 5.8
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for…
-
Medium 5.3
Keycloak: keycloak: denial of service due to excessive samlrequest decompression
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE deco…
-
Medium 5.3
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a p…
-
Low 2.9
Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76129.json
-
report
https://access.redhat.com/security/cve/CVE-2025-9784
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2392306
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-9784
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-9784
-
article
https://github.com/undertow-io/undertow/pull/1778
-
article
https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final
-
article
https://issues.redhat.com/browse/UNDERTOW-2598
-
article
https://kb.cert.org/vuls/id/767506
-
report
https://access.redhat.com/security/cve/CVE-2025-12543
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2408784
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-12543
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-12543
-
report
https://access.redhat.com/security/cve/CVE-2025-14813
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458640
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-14813
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-14813
-
article
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813
-
report
https://access.redhat.com/security/cve/CVE-2026-0603
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2427147
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-0603
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-0603
-
report
https://access.redhat.com/security/cve/CVE-2026-2092
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2437296
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-2092
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-2092
-
report
https://access.redhat.com/security/cve/CVE-2026-2575
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2440149
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-2575
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-2575
-
report
https://access.redhat.com/security/cve/CVE-2026-3505
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458638
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-3505
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-3505
-
article
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505
-
report
https://access.redhat.com/security/cve/CVE-2026-4634
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450250
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-4634