Known vulnerabilities in Red Hat Single Sign-On 7

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-93566	Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line	6.5 Medium	Sep 18, 2026
CVE-2026-10832	Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload	5.9 Medium	Sep 18, 2026
CVE-2026-93565	Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte	7.5 High	Sep 18, 2026
CVE-2026-93564	Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)	7.5 High	Sep 18, 2026
CVE-2026-93558	Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service	7.5 High	Sep 18, 2026
CVE-2026-93560	A flaw was found in the Netty STOMP codec	7.5 High	Sep 18, 2026
CVE-2026-93492	Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size	5.3 Medium	Sep 18, 2026
CVE-2026-93491	Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue	7.5 High	Sep 18, 2026
CVE-2026-93488	Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams	7.5 High	Sep 18, 2026
CVE-2026-93563	A flaw was found in Netty's `SmtpResponseDecoder` component	7.5 High	Sep 18, 2026
CVE-2026-93572	A flaw was found in Netty's `RedisArrayAggregator` component	7.5 High	Sep 18, 2026
CVE-2026-93575	A flaw was found in Netty's MqttDecoder	7.5 High	Sep 18, 2026
CVE-2026-93561	A flaw was found in io.netty/netty-codec-memcache	6.5 Medium	Sep 18, 2026
CVE-2026-93494	A flaw was found in Netty's StompSubframeDecoder component	7.5 High	Sep 18, 2026
CVE-2026-89058	Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config	7.4 High	Sep 18, 2026
CVE-2026-89059	Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)	7.5 High	Sep 18, 2026
CVE-2026-19607	A flaw was found in the first-broker-login flow of the keycloak-services component	5.3 Medium	Sep 16, 2026
CVE-2026-17526	Keycloak is an open-source identity and access management solution	7.2 High	Sep 16, 2026
CVE-2026-79651	A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service…	7.5 High	Sep 16, 2026
CVE-2026-74909	Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security…	8.1 High	Sep 16, 2026
CVE-2026-18212	A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access…	7.5 High	Sep 16, 2026
CVE-2026-92358	Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking	6.4 Medium	Sep 16, 2026
CVE-2026-89298	Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get	4.9 Medium	Sep 11, 2026
CVE-2026-88770	Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts	6.5 Medium	Sep 10, 2026
CVE-2026-19729	Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters	4.9 Medium	Sep 9, 2026

Other Red Hat products