Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.keycloak:keycloak-quarkus-server

9 known vulnerabilities (6 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 6 medium, 3 low
Registry
Maven Central

Advisories 9

  • CVE-2025-11537Medium 5.0

    Keycloak-services: sensitive headers shown in the http access logs

    Affected: fixed in 26.5.6.

  • Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths

    Affected: through 26.2.5.

  • Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console

    Affected: fixed in 26.4.4.

  • CVE-2024-11736Medium 4.9

    Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

    Affected: fixed in 26.0.8.

  • CVE-2024-11734Medium 6.5

    Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers

    Affected: fixed in 26.0.8.

  • CVE-2024-10973Medium 5.7

    Keycloak: cli option for encrypted jgroups ignored

    Affected: from 25.0.0, fixed in 26.0.6.

  • Keycloak-quarkus-server: keycloak path trasversal

    Affected: fixed in 26.0.6; from 25.0.0, fixed in 26.0.6.

  • CVE-2024-10451Medium 5.9

    Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process

    Affected: fixed in 24.0.9; from 25.0.0, fixed in 26.0.6.

  • CVE-2024-9666Medium 4.7

    Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability

    Affected: all versions; from 25.0.0, fixed in 26.0.6.