Issued:
2025-06-09
Updated:
2025-06-09

RHSA-2025:8690 - Important: Red Hat build of Keycloak 26.2.5 Security Update

Synopsis

Important: Red Hat build of Keycloak 26.2.5 Security Update

Type/Severity

Security Advisory Important

Topic

New Red Hat build of Keycloak 26.2.5 packages are available from the Customer Portal

Description

Red Hat build of Keycloak 26.2.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

Security fixes:

  • XStream: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream (CVE-2024-47072)
  • Keycloak hostname verification (CVE-2025-3501)

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Affected Products

ProductVersionArch
Red Hat build of KeycloakText-only Advisoriesx86_64

Fixes

(none)

CVEs

References

Additional information