CVE-2025-11419
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Dec 23, 2025
CISA due date
—
The record
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.keycloak:keycloak-quarkus-dist | 0 | 26.0.16 |
| Maven | org.keycloak:keycloak-quarkus-dist | 26.1.0 | 26.2.10 |
| Maven | org.keycloak:keycloak-quarkus-dist | 26.3.0 | 26.4.1 |
| maven | org.keycloak/keycloak-quarkus-dist | 26.1.0 | 26.2.10 |
| maven | org.keycloak/keycloak-quarkus-dist | 26.3.0 | 26.4.1 |
Related vulnerabilities
- GHSA-q8hq-4h99-fj7x Keycloak TLS Client-Initiated Renegotiation Denial of Service Same vulnerability
- CVE-2025-11538 A vulnerability exists in Keycloak's server distribution where enabling debug mode… Also affects org.keycloak:keycloak-quarkus-dist
- CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled… CWE-770
- CVE-2026-96377 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined… CWE-770
- CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform… CWE-770
- CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource… CWE-770
- CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory… CWE-770
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-770