SB2026091063 - Inconsistent interpretation of HTTP requests in Keycloak
Published: September 10, 2026
Security Bulletin ID
SB2026091063
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-1002)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper implementation of the C. rule of section 5.2.4 of RFC3986. A remote attacker can manipulate Vert.x Web static handler component cache to deny access to static files served by the handler using specifically crafted request URI.
Remediation
Install update from vendor's website.