Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-11419
Good to know:
Date: October 28, 2025
Keycloak is vulnerable to a Denial of Service (DoS) attack due to the default JDK setting that permits Client-Initiated Renegotiation in TLS 1.2. An unauthenticated remote attacker can repeatedly initiate TLS renegotiation requests to exhaust server CPU resources, making the service unavailable. Immediate mitigation is available by setting the "-Djdk.tls.rejectClientInitiatedRenegotiation=true" Java system property in the Keycloak startup configuration.
Severity Score
Severity Score
Weakness Type (CWE)
Top Fix
Upgrade Version
Upgrade to version org.keycloak:keycloak-quarkus-dist:26.0.16;org.keycloak:keycloak-quarkus-dist:26.2.10;org.keycloak:keycloak-quarkus-dist:26.4.1;https://github.com/keycloak/keycloak.git - 26.0.16;https://github.com/keycloak/keycloak.git - 26.2.10;https://github.com/keycloak/keycloak.git - 26.4.1
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | HIGH |