CVE-2025-11419

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11419", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-10-07T11:19:18.134Z", "datePublished": "2025-12-23T20:42:38.699Z", "dateUpdated": "2026-04-20T17:45:58.307Z"}, "containers": {"cna": {"title": "Keycloak: keycloak tls client-initiated renegotiation denial of service", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "26.0.16", "versionType": "semver"}, {"status": "unknown", "version": "26.1.0", "lessThan": "26.1.*", "versionType": "semver"}, {"status": "affected", "version": "26.2.0", "lessThan": "26.2.10", "versionType": "semver"}, {"status": "unknown", "version": "26.3.0", "lessThan": "26.3.*", "versionType": "semver"}, {"status": "affected", "version": "26.4.0", "lessThan": "26.4.1", "versionType": "semver"}], "packageName": "keycloak", "collectionURL": "https://github.com/keycloak/keycloak/", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.0", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhbk/keycloak-operator-bundle", "defaultStatus": "affected", "versions": [{"version": "26.0.16-2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:build_keycloak:26.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.0", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhbk/keycloak-rhel9", "defaultStatus": "affected", "versions": [{"version": "26.0-20", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:build_keycloak:26.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.0", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhbk/keycloak-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "26.0-21", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:build_keycloak:26.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.0.16", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "keycloak-server", "cpes": ["cpe:/a:redhat:build_keycloak:26.0"]}, {"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.2", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhbk/keycloak-operator-bundle", "defaultStatus": "affected", "versions": [{"version": "26.2.10-2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"]}, {"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.2", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhbk/keycloak-rhel9", "defaultStatus": "affected", "versions": [{"version": "26.2-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"]}, {"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.2", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhbk/keycloak-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "26.2-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"]}, {"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.2.10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "keycloak-server", "cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:18254", "name": "RHSA-2025:18254", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18255", "name": "RHSA-2025:18255", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18889", "name": "RHSA-2025:18889", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18890", "name": "RHSA-2025:18890", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-11419", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402142", "name": "RHBZ#2402142", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/keycloak/keycloak/discussions/25209"}, {"url": "https://github.com/keycloak/keycloak/issues/43020"}], "datePublic": "2025-10-07T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling", "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability, configure Keycloak to reject client-initiated TLS renegotiation by adding the following Java system property to the Keycloak startup configuration:\n-Djdk.tls.rejectClientInitiatedRenegotiation=true\n\nThis prevents unauthenticated attackers from triggering repeated TLS renegotiations and exhausting server CPU resources.\nAdditionally, ensure that Keycloak is deployed behind proper network access controls and rate-limiting mechanisms to further reduce exposure to DoS attacks."}], "timeline": [{"lang": "en", "time": "2025-10-07T11:12:36.431Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-10-07T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-04-20T17:45:58.307Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-23T20:51:23.601159Z", "id": "CVE-2025-11419", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-23T20:52:40.059Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11419", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-23T20:51:23.601159Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-23T20:52:32.002Z"}}], "cna": {"title": "Keycloak: keycloak tls client-initiated renegotiation denial of service", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "26.0.16", "versionType": "semver"}, {"status": "unknown", "version": "26.1.0", "lessThan": "26.1.*", "versionType": "semver"}, {"status": "affected", "version": "26.2.0", "lessThan": "26.2.10", "versionType": "semver"}, {"status": "unknown", "version": "26.3.0", "lessThan": "26.3.*", "versionType": "semver"}, {"status": "affected", "version": "26.4.0", "lessThan": "26.4.1", "versionType": "semver"}], "packageName": "keycloak", "collectionURL": "https://github.com/keycloak/keycloak/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.0::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.0", "versions": [{"status": "unaffected", "version": "26.0.16-2", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.0::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.0", "versions": [{"status": "unaffected", "version": "26.0-20", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.0::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.0", "versions": [{"status": "unaffected", "version": "26.0-21", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.0"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.0.16", "packageName": "keycloak-server", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.2", "versions": [{"status": "unaffected", "version": "26.2.10-2", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.2", "versions": [{"status": "unaffected", "version": "26.2-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.2", "versions": [{"status": "unaffected", "version": "26.2-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.2.10", "packageName": "keycloak-server", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-07T11:12:36.431Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-10-07T00:00:00.000Z", "value": "Made public."}], "datePublic": "2025-10-07T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:18254", "name": "RHSA-2025:18254", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18255", "name": "RHSA-2025:18255", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18889", "name": "RHSA-2025:18889", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18890", "name": "RHSA-2025:18890", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-11419", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402142", "name": "RHBZ#2402142", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/keycloak/keycloak/discussions/25209"}, {"url": "https://github.com/keycloak/keycloak/issues/43020"}], "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability, configure Keycloak to reject client-initiated TLS renegotiation by adding the following Java system property to the Keycloak startup configuration:\n-Djdk.tls.rejectClientInitiatedRenegotiation=true\n\nThis prevents unauthenticated attackers from triggering repeated TLS renegotiations and exhausting server CPU resources.\nAdditionally, ensure that Keycloak is deployed behind proper network access controls and rate-limiting mechanisms to further reduce exposure to DoS attacks."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-04-20T17:45:58.307Z"}, "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling"}}, "cveMetadata": {"cveId": "CVE-2025-11419", "state": "PUBLISHED", "dateUpdated": "2026-04-20T17:45:58.307Z", "dateReserved": "2025-10-07T11:19:18.134Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2025-12-23T20:42:38.699Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/keycloak/keycloak/", "defaultStatus": "unaffected", "packageName": "keycloak", "versions": [{"lessThan": "26.0.16", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "26.1.*", "status": "unknown", "version": "26.1.0", "versionType": "semver"}, {"lessThan": "26.2.10", "status": "affected", "version": "26.2.0", "versionType": "semver"}, {"lessThan": "26.3.*", "status": "unknown", "version": "26.3.0", "versionType": "semver"}, {"lessThan": "26.4.1", "status": "affected", "version": "26.4.0", "versionType": "semver"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:build_keycloak:26.0::el9"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-operator-bundle", "product": "Red Hat build of Keycloak 26.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "26.0.16-2", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:build_keycloak:26.0::el9"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9", "product": "Red Hat build of Keycloak 26.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "26.0-20", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:build_keycloak:26.0::el9"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9-operator", "product": "Red Hat build of Keycloak 26.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "26.0-21", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:26.0"], "defaultStatus": "unaffected", "packageName": "keycloak-server", "product": "Red Hat build of Keycloak 26.0.16", "vendor": "Red Hat"}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-operator-bundle", "product": "Red Hat build of Keycloak 26.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "26.2.10-2", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9", "product": "Red Hat build of Keycloak 26.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "26.2-11", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9-operator", "product": "Red Hat build of Keycloak 26.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "26.2-11", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:26.2::el9"], "defaultStatus": "unaffected", "packageName": "keycloak-server", "product": "Red Hat build of Keycloak 26.2.10", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Keycloak. Esta vulnerabilidad permite a un atacante remoto no autenticado provocar una denegaci\u00f3n de servicio (DoS) al iniciar repetidamente solicitudes de renegociaci\u00f3n iniciadas por el cliente TLS?1.2, lo que agota los recursos de CPU del servidor y deja el servicio indisponible."}], "id": "CVE-2025-11419", "lastModified": "2026-10-19T22:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11419", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-23T20:51:23.601159Z", "version": "2.0.3"}}]}, "published": "2025-12-23T21:15:46.557", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:18254"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:18255"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:18889"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:18890"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2025-11419"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402142"}, {"source": "secalert@redhat.com", "url": "https://github.com/keycloak/keycloak/discussions/25209"}, {"source": "secalert@redhat.com", "url": "https://github.com/keycloak/keycloak/issues/43020"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "keycloak: Keycloak TLS Client-Initiated Renegotiation Denial of Service", "id": "2402142", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402142"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, configure Keycloak to reject client-initiated TLS renegotiation by adding the following Java system property to the Keycloak startup configuration:\n-Djdk.tls.rejectClientInitiatedRenegotiation=true\nThis prevents unauthenticated attackers from triggering repeated TLS renegotiations and exhausting server CPU resources.\nAdditionally, ensure that Keycloak is deployed behind proper network access controls and rate-limiting mechanisms to further reduce exposure to DoS attacks."}, "name": "CVE-2025-11419", "package_state": [{"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "keycloak-server", "product_name": "Red Hat Build of Keycloak"}], "public_date": "2025-10-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-11419\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-11419"], "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-22T11:37:31.626836+00:00", "value": {"mitigation_remediation": ["Apply the Red\u00a0Hat security updates RHSA\u20112025\u201118254 and RHSA\u20112025\u201118255 that contain the Keycloak patch.", "If a patch is unavailable, start Keycloak with the Java system property \u2013Djdk.tls.rejectClientInitiatedRenegotiation=true to disable client\u2011initiated TLS renegotiation.", "Configure network\u2011level controls, such as a firewall or web\u2011application firewall, to limit the rate of TLS handshake attempts and further protect the service from potential DoS traffic."], "summary": {"action": "Apply Patches", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The security advisory lists Red\u00a0Hat build of Keycloak 26.0\u2014including the 26.0.16 revision\u2014and Red\u00a0Hat build of Keycloak 26.2, including the 26.2.10 revision, as affected products. All other builds not listed remain unaffected.", "description_and_impact": "A flaw in Keycloak permits an unauthenticated remote attacker to trigger repeated TLS\u00a01.2 client\u2011initiated renegotiation requests, consuming significant CPU resources and rendering the service unavailable. The vulnerability does not affect confidentiality or integrity, but it can be used to cause a temporary loss of availability for any users or clients relying on the Keycloak instance.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a moderate\u2011to\u2011severe risk, yet the EPSS score is below 1\u202f% and the vulnerability is not currently listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. An attacker only needs the ability to connect to the Keycloak server and initiate TLS renegotiation; no authentication or privileged credentials are required. Once engaged, the repeated renegotiation cycles can exhaust CPU resources, leading to a denial of service that lasts until the server restarts or the workload is mitigated."}}}}, "created": "2026-04-22T12:00:05.906242+00:00", "updated": "2026-04-22T12:00:05.906282+00:00", "vendors": []}