GitHub Advisoryadvisory · Maven

GHSA-q8hq-4h99-fj7x Keycloak TLS Client-Initiated Renegotiation Denial of Service

HIGH Published 2025-10-27 Modified 2026-04-24 Official page ↗
Aliases
CVE-2025-11419
Ecosystem
Maven
Packages
org.keycloak:keycloak-quarkus-dist
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2025-10-27

Affected packages

• Maven org.keycloak:keycloak-quarkus-dist: < 26.0.16 → fixed in 26.0.16 • Maven org.keycloak:keycloak-quarkus-dist: >= 26.1.0, < 26.2.10 → fixed in 26.2.10 • Maven org.keycloak:keycloak-quarkus-dist: >= 26.3.0, < 26.4.1 → fixed in 26.4.1

Description

Keycloak is vulnerable to a Denial of Service (DoS) attack due to the default JDK setting that permits Client-Initiated Renegotiation in TLS 1.2. An unauthenticated remote attacker can repeatedly initiate TLS renegotiation requests to exhaust server CPU resources, making the service unavailable. Immediate mitigation is available by setting the `-Djdk.tls.rejectClientInitiatedRenegotiation=true` Java system property in the Keycloak startup configuration.

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References