GHSA-q8hq-4h99-fj7x

Suggest an improvement
Source
https://github.com/advisories/GHSA-q8hq-4h99-fj7x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q8hq-4h99-fj7x/GHSA-q8hq-4h99-fj7x.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-q8hq-4h99-fj7x
Aliases
Published
2025-10-27T20:46:54Z
Modified
2026-05-05T15:56:03Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Keycloak TLS Client-Initiated Renegotiation Denial of Service
Details

Keycloak is vulnerable to a Denial of Service (DoS) attack due to the default JDK setting that permits Client-Initiated Renegotiation in TLS 1.2. An unauthenticated remote attacker can repeatedly initiate TLS renegotiation requests to exhaust server CPU resources, making the service unavailable. Immediate mitigation is available by setting the -Djdk.tls.rejectClientInitiatedRenegotiation=true Java system property in the Keycloak startup configuration.

Database specific 
{
    "cwe_ids":  [
        "CWE-400",
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-27T20:46:54Z",
    "nvd_published_at":  "2025-12-23T21:15:46Z",
    "severity":  "HIGH"
}
References

Affected packages

Maven
org.keycloak:keycloak-quarkus-dist

Package

Name
org.keycloak:keycloak-quarkus-dist
View open source insights on deps.dev
Purl
pkg:maven/org.keycloak/keycloak-quarkus-dist

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
26.0.16

Affected versions

17.*
17.0.0
17.0.1
18.*
18.0.0
18.0.1
18.0.2
19.*
19.0.0
19.0.1
19.0.2
19.0.3
20.*
20.0.0
20.0.1
20.0.2
20.0.3
20.0.5
21.*
21.0.0
21.0.1
21.0.2
21.1.0
21.1.1
21.1.2
22.*
22.0.0
22.0.1
22.0.2
22.0.3
22.0.4
22.0.5
23.*
23.0.0
23.0.1
23.0.2
23.0.3
23.0.4
23.0.5
23.0.6
23.0.7
24.*
24.0.0
24.0.1
24.0.2
24.0.3
24.0.4
24.0.5
25.*
25.0.0
25.0.1
25.0.2
25.0.3
25.0.4
25.0.5
25.0.6
26.*
26.0.0
26.0.1
26.0.2
26.0.4
26.0.5
26.0.6
26.0.7
26.0.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q8hq-4h99-fj7x/GHSA-q8hq-4h99-fj7x.json"
org.keycloak:keycloak-quarkus-dist

Package

Name
org.keycloak:keycloak-quarkus-dist
View open source insights on deps.dev
Purl
pkg:maven/org.keycloak/keycloak-quarkus-dist

Affected ranges

Type
ECOSYSTEM
Events
Introduced
26.1.0
Fixed
26.2.10

Affected versions

26.*
26.1.0
26.1.1
26.1.2
26.1.3
26.1.4
26.1.5
26.2.0
26.2.1
26.2.2
26.2.3
26.2.4
26.2.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q8hq-4h99-fj7x/GHSA-q8hq-4h99-fj7x.json"
org.keycloak:keycloak-quarkus-dist

Package

Name
org.keycloak:keycloak-quarkus-dist
View open source insights on deps.dev
Purl
pkg:maven/org.keycloak/keycloak-quarkus-dist

Affected ranges

Type
ECOSYSTEM
Events
Introduced
26.3.0
Fixed
26.4.1

Affected versions

26.*
26.3.0
26.3.1
26.3.2
26.3.3
26.3.4
26.3.5
26.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q8hq-4h99-fj7x/GHSA-q8hq-4h99-fj7x.json"