Resource exhaustion in Keycloak - CVE-2025-11419
Published: October 27, 2025 / Updated: November 17, 2025
Vulnerability identifier: #VU117685
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-11419
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the default JDK setting that permits Client-Initiated Renegotiation in TLS 1.2. A remote attacker can repeatedly initiate TLS renegotiation requests to exhaust server CPU resources, making the service unavailable.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2025-11419
Install updates from vendor's website.
Keycloak - addressed in versions 26.0.16, 26.2.10, 26.4.1
Red Hat build of Keycloak - addressed in versions 26.0.16, 26.2.10
Red Hat build of Keycloak - addressed in versions 26.0.16, 26.2.10