org.keycloak:keycloak-quarkus-server-app (=14.0.0), org.keycloak:keycloak-quarkus-server-deployment (=14.0.0) potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (=14.0.0)

org.keycloak:keycloak-quarkus-server MAVEN version =14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-quarkus-server-app =14.0.0 -...

io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0), org.keycloak:keycloak-guides (>=21.0.0 <=21.1.2) +5 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=21.0.0 <=21.1.2)

org.keycloak:keycloak-quarkus-server MAVEN version =21.0.0, =0.1.0, =21.0.0, =21.0.0, =21.1.0, =21.0.0, =21.0.0, =21.0.0, =21.1.2 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-quarkus-server-app (>=12.0.0 <=12.0.4), org.keycloak:keycloak-quarkus-server-deployment (>=12.0.0 <=12.0.4) potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=12.0.0 <=12.0.4)

org.keycloak:keycloak-quarkus-server MAVEN version =12.0.0, =12.0.0, =12.0.0, =12.0.4 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0 <=4.0.5-25.0), org.keycloak:keycloak-guides (>=25.0.0 <=25.0.6) +4 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=25.0.0 <=25.0.6)

org.keycloak:keycloak-quarkus-server MAVEN version =25.0.0, =3.0.1-25.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.6 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=20.0.0 <=20.0.5), org.keycloak:keycloak-guides-maven-plugin (>=20.0.0 <=20.0.5) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=20.0.0 <=20.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version =20.0.0, =20.0.0, =20.0.0, =20.0.0, =20.0.0, =20.0.0, =20.0.5 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0 <=2.7.4-24.0), org.keycloak:keycloak-guides (>=24.0.0 <=24.0.5) +4 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=24.0.0 <=24.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version =24.0.0, =2.5.6-24.0, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.0.5 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=19.0.0 <=19.0.3), org.keycloak:keycloak-guides-maven-plugin (>=19.0.0 <=19.0.3) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=19.0.0 <=19.0.3)

org.keycloak:keycloak-quarkus-server MAVEN version =19.0.0, =19.0.0, =19.0.0, =19.0.0, =19.0.0, =19.0.0, =19.0.3 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=15.1.0 <=15.1.1), org.keycloak:keycloak-guides-maven-plugin (>=15.1.0 <=15.1.1) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=15.0.0 <=15.1.1)

org.keycloak:keycloak-quarkus-server MAVEN version =15.0.0, =15.1.0, =15.1.0, =15.1.0, =15.0.0, =15.0.0, =15.1.1 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-quarkus-server-app (>=13.0.0 <=13.0.1), org.keycloak:keycloak-quarkus-server-deployment (>=13.0.0 <=13.0.1) potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=13.0.0 <=13.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version =13.0.0, =13.0.0, =13.0.0, =13.0.1 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=22.0.0 <=22.0.5), org.keycloak:keycloak-guides-maven-plugin (>=22.0.0 <=22.0.5) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=22.0.0 <=22.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version =22.0.0, =22.0.0, =22.0.0, =22.0.0, =22.0.0, =22.0.0, =22.0.5 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

GHSA-JGWC-JH89-RPGQ vulnerabilities

Vulnerabilities for packages: keycloak...

Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

Keycloak versions 26 and earlier are vulnerable to a denial-of-service DoS attack through improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This can lead to cost...

org.keycloak:keycloak-guides (>=23.0.0 <=23.0.7), org.keycloak:keycloak-guides-maven-plugin (>=23.0.0 <=23.0.7) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=23.0.0 <=23.0.7)

org.keycloak:keycloak-quarkus-server MAVEN version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.7 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=18.0.0 <=18.0.2), org.keycloak:keycloak-guides-maven-plugin (>=18.0.0 <=18.0.2) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=18.0.0 <=18.0.2)

org.keycloak:keycloak-quarkus-server MAVEN version =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.2 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=4.1.0-26.0 <=5.5.1), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=8.1 <=9.1) +24 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=26.0.0 <=26.5.6)

org.keycloak:keycloak-quarkus-server MAVEN version =26.0.0, =4.1.0-26.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.2.0, =26.2.0, =26.1.0, =26...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0 <=4.0.5-25.0), org.keycloak:keycloak-guides (>=25.0.0 <=26.0.5) +6 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=25.0.0 <=26.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version =25.0.0, =3.0.1-25.0, =25.0.0, =25.0.0, =25.0.0, =26.0.0, =25.0.0, =25.0.0, =26.0.0, =26.0.5 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

GHSA-JGWC-JH89-RPGQ Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

Keycloak versions 26 and earlier are vulnerable to a denial-of-service DoS attack through improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This can lead to cost...

GHSA-JGWC-JH89-RPGQ vulnerabilities

Vulnerabilities for packages: keycloak...

org.keycloak:keycloak-guides (>=17.0.0 <=17.0.1), org.keycloak:keycloak-guides-maven-plugin (>=17.0.0 <=17.0.1) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=17.0.0 <=17.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version =17.0.0, =17.0.0, =17.0.0, =17.0.0, =17.0.0, =17.0.0, =17.0.1 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=16.0.0 <=16.1.1), org.keycloak:keycloak-guides-maven-plugin (>=16.0.0 <=16.1.1) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=16.0.0 <=16.1.1)

org.keycloak:keycloak-quarkus-server MAVEN version =16.0.0, =16.0.0, =16.0.0, =16.0.0, =16.0.0, =16.0.0, =16.1.1 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...