Security
فارسی
All products

Red Hat Build of Keycloak/keycloak/rhbk-rhel9-operator

Red Hat · Package
16 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-68494 · GHSA-R7WM-3CXJ-WFF9 com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core MavenRed Hat High Fix reported
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89425 · GHSA-7HHH-6RMP-J9QF com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core MavenRed Hat High Fix reported
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
com.github.java-json-tools/jackson-coreutils: jackson-coreutils: Remote Denial of Service via resource consumptionCVE-2026-86511 Red Hat Build of Keycloak/jackson-coreutilsRed Hat Build of Keycloak/keycloak/rhbk-rhel9-operator Red Hat Medium No fix reported
keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuerCVE-2026-93998 Red Hat Build of Keycloak/keycloak-coreRed Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9 Red Hat High No fix reported
io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofingCVE-2026-59296 Exploit Intelligence/exploit-intelligence/agent-client-rhel9Red Hat AMQ Broker 7/micrometer-core Red Hat Medium No fix reported
io.netty/netty-codec-socks: Netty: Null byte and CRLF injection in SOCKS client encoders can lead to domain spoofingCVE-2026-62380 Exploit Intelligence/exploit-intelligence/agent-client-rhel9OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 Red Hat Medium No fix reported
java-json-tools/json-patch: java-json-tools json-patch: Remote stack-based buffer overflow via JSON manipulationCVE-2026-86318 Red Hat Build of Keycloak/json-patchRed Hat Build of Keycloak/keycloak/rhbk-rhel9-operator Red Hat Medium No fix reported
com.github.java-json-tools/json-patch: java-json-tools json-patch: Resource Consumption VulnerabilityCVE-2026-86319 Red Hat Build of Keycloak/json-patchRed Hat Build of Keycloak/keycloak/rhbk-rhel9-operator Red Hat Medium No fix reported
com.github.java-json-tools/json-patch: java-json-tools json-patch: Improper Access Control in Copy/Move OperationsCVE-2026-86512 Red Hat Build of Keycloak/json-patchRed Hat Build of Keycloak/keycloak/rhbk-rhel9-operator Red Hat Medium No fix reported
quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP SecurityCVE-2026-87743 Red Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9Red Hat Build of Keycloak/keycloak/rhbk-rhel9-operator Red Hat High No fix reported
io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue in WebSocketServerExtensionHandlerCVE-2026-100658 Exploit Intelligence/exploit-intelligence/agent-client-rhel9OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 Red Hat Medium No fix reported
io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodecCVE-2026-100666 Exploit Intelligence/exploit-intelligence/agent-client-rhel9OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 Red Hat High No fix reported