Keycloak Denial-of-Service Vulnerability via Security Header Manipulation

A denial-of-service vulnerability exists in Keycloak that allows an administrative user with the authority to change realm settings to disrupt service. This is achieved by altering security headers and adding newlines, which causes the Keycloak server to process a request that has already been terminated, resulting in the failure of that request. Consequently, users may experience disruptions when accessing applications that rely on Keycloak or its administrative consoles within the affected realm.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition on the Keycloak server, causing service disruptions for users and applications dependent on Keycloak for authentication and authorization.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.0.8, which addresses this vulnerability. Instructions for applying this update are available on the Red Hat Customer Portal.