RHSA-2026:95759: Important: Red Hat build of Keycloak 26.4.17 Security Update

Red Hat build of Keycloak 26.4.17 is a standalone server, based onthe Keycloak project, that provides authentication andstandards-based single sign-on capabilities for web and mobileapplications.Security fixes: Account takeover via authentication race using reset-credentials path (CVE-2026-103112) Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602) PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879) Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931) UMA Protection API resourceType field not validated — cross-owner resource access (CVE-2026-114232) Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860) Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506) SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217) Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611) Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059) Information disclosure via CORS Vary header overwrite (CVE-2026-59903) SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595) SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874) Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965) Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763) SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855) DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857) Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488) Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491) HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492) Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558) Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562) HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564) Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565) HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566) HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567) HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568) HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569) Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573) HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574) HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579) SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998) kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453) DCR registration-time claim-path gap allows forging realmaccess.roles (CVE-2026-96547) Unverified IdP email auto-linking enables account takeover (CVE-2026-97175) DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367) Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847) Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)

— Red Hat