CVE-2025-11419highCWE-770

CVE-2025-11419: falha de alta gravidade em keycloak

Keycloak: keycloak tls client-initiated renegotiation denial of service

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat build of Keycloak+ Monitorar keycloak

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.7%
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
keycloakRed Hat · Red Hat build of Keycloak 26.0Red Hat · Red Hat build of Keycloak 26.0.16Red Hat · Red Hat build of Keycloak 26.2Red Hat · Red Hat build of Keycloak 26.2.10
CVEs relacionadas — keycloak

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3656HIGHKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesEPSS 3.3%CVE-2024-8698HIGHKeycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloakEPSS 2.0%CVE-2024-1132HIGHKeycloak: path transversal in redirection validationEPSS 1.6%CVE-2024-10270MEDIUMOrg.keycloak:keycloak-services: keycloak denial of serviceEPSS 1.2%CVE-2023-6484MEDIUMKeycloak: log injection during webauthn authentication or registrationEPSS 1.0%CVE-2024-11734MEDIUMOrg.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headersEPSS 0.9%