CVE-2024-9666
Keycloak proxy header handling Denial-of-Service (DoS) vulnerability
Reported by redhat · Published November 25, 2024
keycloak is fixed in 26.0.6 and 24.0.9 (GitHub Packages)
A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service. The attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| keycloak | GitHub Packages | 26.0.6, 24.0.9 |
| org.keycloak:keycloak-quarkus-server | Maven Central | 26.0.6, 24.0.9 |
| keycloak | Chainguard | 26.0.6-r0 |
| keycloak-fips | Chainguard | 26.0.6-r0 |
| keycloak | dhi.docker.com | 26.0.6, 24.0.9 |
| keycloak | Wolfi | 26.0.6-r0 |
| keycloak | DHI | 26.0.6, 24.0.9 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| 0, 25.0.0 | ||
| Red Hat | Red Hat build of Keycloak 24 | 24.0.9-1 |
| Red Hat | Red Hat build of Keycloak 24 | 24-18 |
| Red Hat | Red Hat build of Keycloak 24 | 24-18 |
| Red Hat | Red Hat build of Keycloak 24.0.9 | |
| Red Hat | Red Hat build of Keycloak 26.0 | 26.0.6-2 |
| Red Hat | Red Hat build of Keycloak 26.0 | 26.0-5 |
| Red Hat | Red Hat build of Keycloak 26.0 | 26.0-6 |
| Red Hat | Red Hat build of Keycloak 26.0.6 | |
| Red Hat | Red Hat Build of Keycloak | |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | |
| Red Hat | Red Hat build of Keycloak 24 | 24.0.9-1 |
| Red Hat | Red Hat build of Keycloak 26.0 | 26.0-6 |
| Red Hat | Red Hat build of Keycloak 26.0.6 | |
| Red Hat | Red Hat build of Keycloak 24.0.9 | |
| chainguard | keycloak | 0 |
| chainguard | keycloak-fips | 0 |
| Red Hat | Red Hat build of Keycloak 24.0.9 | |
| Red Hat | Red Hat build of Keycloak 26.0.6 | |
| 25.0.0, 0 |
…and 11 more
Timeline
- Nov 21, 2024 CVE Published
- Nov 22, 2024 PoC Published (2 in total, the first dated here)
- Nov 25, 2024 CVE Updated
- Nov 26, 2024 EPSS Score (30 in total, the first dated here)
- Dec 28, 2024 Coalition ESS Score (12 in total, the first dated here)
- Mar 17, 2026 Security Advisory (7 in total, the first dated here)
- Aug 10, 2026 Distribution Patch (6 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-9666
vulnetix vdb fixes CVE-2024-9666Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-9666/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- RHSA-2024:10175 vendor-advisoryx_refsource_REDHAT
- RHSA-2024:10176 vendor-advisoryx_refsource_REDHAT
- RHSA-2024:10177 vendor-advisoryx_refsource_REDHAT
- RHSA-2024:10178 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2317440 issue-trackingx_refsource_REDHAT
- https://nvd.nist.gov/vuln/detail/CVE-2024-9666 advisory
- https://github.com/advisories/GHSA-jgwc-jh89-rpgq advisory
- https://github.com/keycloak/keycloak/security/advisories/GHSA-jgwc-jh89-rpgq url
- https://github.com/keycloak/keycloak/issues/35216 url
- https://github.com/keycloak/keycloak url