RHSA-2026:95760: Important: Red Hat build of Keycloak 26.4.17 Images Security Update

Red Hat build of Keycloak is an integrated sign-on solution,available as a Red Hat JBoss Middleware for OpenShift containerizedimage. The Red Hat build of Keycloak for OpenShift image providesan authentication server that you can use to log in centrally, logout, and register. You can also manage user accounts for webapplications, mobile applications, and RESTful web services.Red Hat build of Keycloak Operator for OpenShift simplifiesdeployment and management of Keycloak 26.4.17 clusters.This erratum releases new images for Red Hat build of Keycloak26.4.17 for use within the OpenShift Container Platform cloudcomputing Platform-as-a-Service (PaaS) for on-premise or privatecloud deployments, aligning with the standalone product release.Security fixes: Account takeover via authentication race using reset-credentials path (CVE-2026-103112) Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602) PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879) Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931) UMA Protection API resourceType field not validated — cross-owner resource access (CVE-2026-114232) Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860) Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506) SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217) Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611) Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059) Information disclosure via CORS Vary header overwrite (CVE-2026-59903) SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595) SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874) Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965) Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763) SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855) DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857) Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488) Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491) HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492) Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558) Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562) HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564) Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565) HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566) HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567) HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568) HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569) Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573) HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574) HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579) SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998) kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453) DCR registration-time claim-path gap allows forging realmaccess.roles (CVE-2026-96547) Unverified IdP email auto-linking enables account takeover (CVE-2026-97175) DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367) Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847) Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)

— Red Hat