# Keycloak TLS 1.2 renegotiation denial of service

Source: https://startwithidentity.com/cves/cve-2025-11419/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

Keycloak's TLS 1.2 stack could be driven into a renegotiation loop that exhausted the node. Red Hat patched. This is a denial of service, not a login bypass.

## Why it matters

An IdP that is down is an identity incident. Password-reset and help-desk social engineering spike immediately, the same lesson as [ruby-saml's compression DoS](https://startwithidentity.com/cves/cve-2025-25293/).

## What to do

- Upgrade Keycloak. Prefer TLS 1.3 on the load balancer so renegotiation never reaches the app.
- Keep a break-glass local admin that does not depend on the public login path.

## After you patch

Patching closes the entry point. It does not remove access an attacker established through it.

- **Revoke sessions and API tokens** on the affected system rather than only resetting passwords.
- **Audit accounts, tokens, and administrative changes** made during the exposure window.
- **Rotate credentials the system stored or could reach**, including directory service accounts and integration keys. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/).
- **Treat the system as a pivot**: whatever it could authenticate to is in scope until you have checked it.

## Sources

- [NVD: CVE-2025-11419](https://nvd.nist.gov/vuln/detail/CVE-2025-11419)