RHBA-2025:7639MediumCVSS 7.4

Red Hat Bug Fix Advisory: Red Hat build of Keycloak 26.2.4 Images Update

Published
May 14, 2025
Last Modified
October 30, 2026

🔗 CVE IDs covered (3)

CVE-2020-11023 →CVE-2024-12397 →CVE-2025-0395 →

📋 Description

CVE-2020-11023 — jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2024-12397 — io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling CVE-2025-0395 — glibc: buffer overflow in the GNU C Library's assert()

🎯 Affected products10

  • Red Hat build of Keycloak 26.2
  • rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64 as a component of Red Hat build of Keycloak 26.2
  • rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le as a component of Red Hat build of Keycloak 26.2
  • rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x as a component of Red Hat build of Keycloak 26.2
  • rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64 as a component of Red Hat build of Keycloak 26.2
  • rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64 as a component of Red Hat build of Keycloak 26.2
  • rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64 as a component of Red Hat build of Keycloak 26.2
  • rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le as a component of Red Hat build of Keycloak 26.2
  • rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64 as a component of Red Hat build of Keycloak 26.2
  • rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x as a component of Red Hat build of Keycloak 26.2

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Currently, no mitigation is available for this vulnerability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (2)