255335 matches found
ECHO-96F7-2B0E-5704
Bulletin has no description...
ECHO-DC91-3169-C604
Bulletin has no description...
ECHO-E0BB-5E4C-E923
Bulletin has no description...
ECHO-DE50-284B-655F
Bulletin has no description...
ECHO-C510-2382-A0DB
Bulletin has no description...
ECHO-B304-A795-3DAB
Bulletin has no description...
ECHO-86FC-E38B-C83B
Bulletin has no description...
ECHO-CC7D-8394-7880
Bulletin has no description...
ECHO-A65A-C6E8-0F1D
Bulletin has no description...
ECHO-6E54-DE1B-08C9
Bulletin has no description...
ECHO-A405-9171-9BA2
Bulletin has no description...
ECHO-FEA2-5EA1-2849
Bulletin has no description...
ECHO-7EDB-23C5-02EC
Bulletin has no description...
ECHO-3D2B-DE07-3BBE
Bulletin has no description...
ECHO-90F5-FFF7-E790
Bulletin has no description...
ECHO-1EC0-58D1-CB3D Keycloak's GHSA advisory (GHSA-gv3v-2cpp-3pmq) lists the affected package/range as org.keycloak:keycloak-quarkus-server < 26.5.6 with no lower bound, so by version string alone 25.0.6 is nominally in range. The actual vulnerable mechanism is the HTTP access log feature (config.HttpAccessLogOptions, HttpAccessLogPropertyMappers) added by the fix commit's PR to mask Authorization/Cookie headers in a verbose access-log pattern. That feature does not exist in 25.0.6 at all — confirmed via a full source search (no HttpAccessLogOptions.java, HttpAccessLogPropertyMappers.java, or any http-access-log config option anywhere in quarkus/config-api or quarkus/runtime). There is no access-log-pattern mechanism in this version capable of the described header disclosure.
Bulletin has no description...
ECHO-1969-C688-A45C Keycloak's GHSA advisory (GHSA-rr5q-3xwr-f323) lists the affected range as < 26.6.3 with no lower bound, so by version string alone 25.0.6 is nominally in range. The actual vulnerability requires a generic parameter-length-limiting mechanism (OIDCProviderConfig's max-length-per-parameter config, TokenEndpoint's checkParameters() gate) that silently drops any oversized request parameter, including subject_token — the fix exempts token-shaped parameters from that drop via a new getTokenParameterNames() method. That length-limiting framework does not exist anywhere in 25.0.6 (same finding as CVE-2026-4634, investigated separately) — confirmed via source search, no getMaxLengthForTheParameter/checkParameters/length-cap mechanism exists on any OIDC grant-type endpoint. With no mechanism to silently drop an oversized subject_token, the described fallback to client-credentials cannot occur.
Bulletin has no description...
ECHO-3050-E6F8-F8C9
Bulletin has no description...