SB2025060956 - Multiple vulnerabilities in Red Hat build of Keycloak 26.2
Published: June 9, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2024-47072)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing unstrusted input. A remote attacker can pass a specially crafted stream to the application, trigger a stack overflow and perform a denial of service (DoS) attack.
Successful exploitation of this vulnerability requires that XStream is configured to use the BinaryStreamDriver.
2) Improper validation of certificate with host mismatch (CVE-ID: CVE-2025-3501)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error in org.keycloak.protocol.services package, when setting a verification policy to "ALL", which causes the application to skip trust store certificate verification. A remote attacker can perform MitM attack.
3) Resource exhaustion (CVE-ID: CVE-2024-12133)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources processing a large number of SEQUENCE OF or SET OF elements in a certificate. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.