Identity CVE · Other
CVE-2025-11419Keycloak TLS 1.2 renegotiation denial of service
medium
What broke
Keycloak's TLS 1.2 stack could be driven into a renegotiation loop that exhausted the node. Red Hat patched. This is a denial of service, not a login bypass.
Why it matters
An IdP that is down is an identity incident. Password-reset and help-desk social engineering spike immediately, the same lesson as ruby-saml's compression DoS.
What to do
- Upgrade Keycloak. Prefer TLS 1.3 on the load balancer so renegotiation never reaches the app.
- Keep a break-glass local admin that does not depend on the public login path.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.