PT-2025-44075 · Red Hat · Keycloak

Osidb Bzimport · CVE-2025-11419 · Published 2025-10-27 · Updated 2026-02-13

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description Keycloak is susceptible to a Denial of Service (DoS) attack. This is due to a default Java Development Kit (JDK) setting that allows Client-Initiated Renegotiation within the TLS 1.2 protocol. An attacker who does not need to be authenticated can send repeated TLS renegotiation requests. This can overwhelm the server's CPU, leading to service unavailability.

Recommendations Set the -Djdk.tls.rejectClientInitiatedRenegotiation=true Java system property in the Keycloak startup configuration.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2025-11419

GHSA-Q8HQ-4H99-FJ7X

Affected Products

Keycloak

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11419.json · Exploit
• https://access.redhat.com/errata/RHSA-2025:18254 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8hq-4h99-fj7x · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:18890 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11419 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:18255 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:18889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11419 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/discussions/25209 · Note
• https://github.com/keycloak/keycloak/issues/43020 · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-q8hq-4h99-fj7x · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11419 · Note
• https://reddit.com/r/VulnMatter/comments/1oibp2u/resumen_diario_de_vulnerabilidades_28102025 · Reddit Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2402142 · Note