CVE-2025-11419

Keycloak: keycloak tls client-initiated renegotiation denial of service

State: Published
Severity: 7.5 High
Published: Dec 23, 2025
Updated: Apr 20, 2026
Reserved: Oct 7, 2025

Description

A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	redhat

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
keycloak	before 26.0.16Affected 26.1.0 to before 26.1.Unknown 26.2.0 to before 26.2.10Affected 26.3.0 to before 26.3.Unknown 26.4.0 to before 26.4.1Affected
Red Hat build of Keycloak 26.0Red Hat	26.0.16-2 and laterNot affected
Red Hat build of Keycloak 26.0Red Hat	26.0-20 and laterNot affected
Red Hat build of Keycloak 26.0Red Hat	26.0-21 and laterNot affected
Red Hat build of Keycloak 26.0.16Red Hat
Red Hat build of Keycloak 26.2Red Hat	26.2.10-2 and laterNot affected
Red Hat build of Keycloak 26.2Red Hat	26.2-11 and laterNot affected
Red Hat build of Keycloak 26.2Red Hat	26.2-11 and laterNot affected
Red Hat build of Keycloak 26.2.10Red Hat

References

RHSA-2025:18254vendor-advisory
RHSA-2025:18255vendor-advisory
RHSA-2025:18889vendor-advisory
RHSA-2025:18890vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-11419vdb-entry
RHBZ#2402142issue-tracking
https://github.com/keycloak/keycloak/discussions/25209
https://github.com/keycloak/keycloak/issues/43020

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.