Medium

Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability

Type: advisorySource: Official CVE List1 source record

A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service. The attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.

Announced 25 Nov 2024Source revision 1

Original source ↗

CVE-2024-9666

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-9666

Red Hat build of Keycloak 24

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 24

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 24

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 24.0.9

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.0

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.0

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.0

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.0.6

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 8

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "24.0.9",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "25.0.0",
        "lessThan": "26.0.6",
        "versionType": "semver"
      }
    ],
    "packageName": "keycloak",
    "collectionURL": "https://github.com/keycloak/keycloak",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:24::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 24",
    "versions": [
      {
        "status": "unaffected",
        "version": "24.0.9-1",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-operator-bundle",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:24::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 24",
    "versions": [
      {
        "status": "unaffected",
        "version": "24-18",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:24::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 24",
    "versions": [
      {
        "status": "unaffected",
        "version": "24-18",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-rhel9-operator",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:24"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 24.0.9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.0::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.0",
    "versions": [
      {
        "status": "unaffected",
        "version": "26.0.6-2",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-operator-bundle",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.0::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.0",
    "versions": [
      {
        "status": "unaffected",
        "version": "26.0-5",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.0::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.0",
    "versions": [
      {
        "status": "unaffected",
        "version": "26.0-6",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-rhel9-operator",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.0"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.0.6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "keycloak-quarkus-server",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 8",
    "packageName": "keycloak-quarkus-server",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  }
]

Related CVEs: CVE-2024-9666
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #21310 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:42:58 GMT
Publisher date: Mon, 25 Nov 2024 07:29:52 GMT

Read the original announcement