PT-2025-44075 · Red Hat · Keycloak

Osidb Bzimport · Published 2025-10-27 · Updated 2026-02-13 · CVE-2025-11419

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description Keycloak is susceptible to a Denial of Service (DoS) attack. This is due to a default Java Development Kit (JDK) setting that allows Client-Initiated Renegotiation within the TLS 1.2 protocol. An attacker who does not need to be authenticated can send repeated TLS renegotiation requests. This can overwhelm the server's CPU, leading to service unavailability.

Recommendations Set the -Djdk.tls.rejectClientInitiatedRenegotiation=true Java system property in the Keycloak startup configuration.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2025-11419

GHSA-Q8HQ-4H99-FJ7X

Affected Products

Keycloak

References · 18

• https://access.redhat.com/errata/RHSA-2025:18889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11419 · Security Note
• https://access.redhat.com/errata/RHSA-2025:18890 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:18255 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:18254 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8hq-4h99-fj7x · Vendor Advisory
• https://github.com/keycloak/keycloak/discussions/25209 · Note
• https://github.com/keycloak/keycloak/issues/43020 · Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-q8hq-4h99-fj7x · Note
• https://twitter.com/CVEnew/status/2003700589415530520 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11419 · Note
• https://twitter.com/transilienceai/status/2022151614501417446 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2025-11419 · Note
• https://twitter.com/VolerionSec/status/2003578474242396671 · Twitter Post