keycloak-26.6

Direct Vulnerabilities

Known vulnerabilities in the keycloak-26.6 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Handling of Alternate Encoding	<26.6.7-r3
L GHSA-q86x-4w7f-8hrm	<26.6.7-r3
L GHSA-27j2-h3m2-8237	<26.6.7-r3
L Resource Exhaustion	<26.6.7-r3
L GHSA-h79m-h3j4-r7qm	<26.6.7-r3
L Directory Traversal	<26.6.7-r3
L GHSA-ghgq-7g74-28wp	<26.6.7-r1
C CVE-2026-59650	<26.6.7-r1
L GHSA-j295-77c3-9frf	<26.6.7-r3
C CVE-2026-58062	<26.6.7-r3
C CVE-2026-8763	<26.6.7-r1
H CVE-2026-13506	<26.6.7-r1
L GHSA-9pwp-9qqc-pr26	<26.6.7-r1
L GHSA-qp49-qgx5-5m26	<26.6.7-r1
L GHSA-jjmj-jmhj-qwj2	<26.6.7-r0
L Cross-site Scripting (XSS)	<26.6.7-r0
L GHSA-c4c3-7fpv-j4q5	<26.6.6-r1
C Improper Check for Unusual or Exceptional Conditions	<26.6.6-r1
L GHSA-fccg-mwvh-qqg4	<26.6.6-r1
H Algorithmic Complexity	<26.6.6-r1
L GHSA-mfg7-5gfp-c4w3	<26.6.6-r0
L GHSA-p3v8-fm5p-v84h	<26.6.6-r0
H Improper Verification of Cryptographic Signature	<26.6.6-r0
M Improper Validation of Consistency within Input	<26.6.6-r0
L CVE-2026-40983	<26.6.6-r0
H Missing Release of Resource after Effective Lifetime	<26.6.6-r0
H Resource Exhaustion	<26.6.6-r0
L GHSA-g3pr-3p32-fp23	<26.6.6-r0
L GHSA-w737-wx49-qj23	<26.6.6-r0
L GHSA-wh89-7897-x99h	<26.6.6-r0
L CRLF Injection	<26.6.6-r0
L GHSA-q6cq-mhr2-jmr5	<26.6.6-r0
L GHSA-q6h7-xxp7-7429	<26.6.6-r0
L GHSA-wcvj-vpvw-9rr5	<26.6.6-r0
M Authentication Bypass by Primary Weakness	<26.6.6-r0
L CVE-2026-40984	<26.6.6-r0
H Allocation of Resources Without Limits or Throttling	<26.6.4-r24
M CRLF Injection	<26.6.4-r24
L GHSA-q4f6-jm68-57ww	<26.6.4-r24
L GHSA-jppx-w49h-x2qq	<26.6.4-r24
L GHSA-4mp9-239f-g9hg	<26.6.4-r24
L Resource Exhaustion	<26.6.4-r24
L GHSA-gcjf-9mgh-3p7g	<26.6.4-r24
L GHSA-8c42-7qj2-3j46	<26.6.4-r24
L GHSA-mvh2-crg5-v77c	<26.6.4-r24
L GHSA-6jqx-86gh-f27w	<26.6.4-r24
H Resource Exhaustion	<26.6.4-r24
L Resource Exhaustion	<26.6.4-r24
L GHSA-6cqp-g7gg-8hr5	<26.6.4-r24
H Information Exposure Through Caching	<26.6.4-r24
L Improper Access Control	<26.6.4-r24
H HTTP Request Smuggling	<26.6.4-r24
L GHSA-93wv-jw9v-4972	<26.6.4-r21
M HTTP Request Smuggling	<26.6.4-r21
L GHSA-c69g-56f8-xwqj	<26.6.4-r21
L Resource Exhaustion	<26.6.4-r21
L GHSA-558v-64gr-wgg4	<26.6.4-r20
H Loop with Unreachable Exit Condition ('Infinite Loop')	<26.6.4-r20
L GHSA-j92g-9f8w-j867	<26.6.4-r19
L Not Failing Securely ('Failing Open')	<26.6.4-r19
L GHSA-4fh9-h7wg-q85m	<26.6.4-r17
M CVE-2025-66400	<26.6.4-r17
L Improperly Controlled Modification of Dynamically-Determined Object Attributes	<26.6.4-r16
L GHSA-5jmj-h7xm-6q6v	<26.6.4-r16
L Improper Handling of Case Sensitivity	<26.6.4-r15
M Open Redirect	<26.6.4-r14
L GHSA-2j2x-hqr9-3h42	<26.6.4-r14
L Incomplete Blacklist	<26.6.4-r1
L GHSA-rcqc-6cw3-h962	<26.6.4-r1
L Incomplete Blacklist	<26.6.4-r1
L Incorrect Authorization	<26.6.4-r1
L Server-Side Request Forgery (SSRF)	<26.6.4-r1
L GHSA-hgj6-7826-r7m5	<26.6.4-r1
L GHSA-9fxm-vc8v-hj55	<26.6.4-r1
L GHSA-5hh8-q8hv-fr38	<26.6.4-r1
L Improperly Controlled Modification of Dynamically-Determined Object Attributes	<26.6.4-r1
L Incorrect Authorization	<26.6.4-r1
L GHSA-rmj7-2vxq-3g9f	<26.6.4-r1
L GHSA-j3rv-43j4-c7qm	<26.6.4-r1
L HTTP Request Smuggling	<26.6.3-r5
L GHSA-hvcg-qmg6-jm4c	<26.6.3-r5
L Information Exposure	<26.6.3-r4
L GHSA-w573-9ffj-6ff9	<26.6.3-r4
L Use of Insufficiently Random Values	<26.6.3-r3
C Insufficient Verification of Data Authenticity	<26.6.3-r3
L Resource Exhaustion	<26.6.3-r3
L Improper Check or Handling of Exceptional Conditions	<26.6.3-r3
L GHSA-c2gf-v879-257j	<26.6.3-r3
C Insufficient Verification of Data Authenticity	<26.6.3-r3
H Resource Exhaustion	<26.6.3-r3
L GHSA-676x-f7gg-47vc	<26.6.3-r3
L GHSA-cc37-9q2j-3hfv	<26.6.3-r3
L GHSA-xmv7-r254-6q78	<26.6.3-r3
L GHSA-5pvg-856g-cp85	<26.6.3-r3
L GHSA-5x3r-wrvg-rp6q	<26.6.3-r3
L GHSA-x4gw-5cx5-pgmh	<26.6.3-r2
L Improper Access Control	<26.6.3-r2
L Allocation of Resources Without Limits or Throttling	<26.6.3-r2
L GHSA-3qp7-7mw8-wx86	<26.6.3-r2
L GHSA-3g76-f9xq-8vp6	<26.6.1-r5
L GHSA-rc95-pcm8-65v9	<26.6.1-r5
H Incorrect Authorization	<26.6.1-r5
M Allocation of Resources Without Limits or Throttling	<26.6.1-r5
L CVE-2026-5588	<26.6.1-r4
L GHSA-p93r-85wp-75v3	<26.6.1-r4
L GHSA-c3fc-8qff-9hwx	<26.6.1-r4
L CVE-2026-0636	<26.6.1-r4
L GHSA-wg6q-6289-32hp	<26.6.1-r4
L CVE-2026-5598	<26.6.1-r4
L Allocation of Resources Without Limits or Throttling	<26.6.1-r3
L GHSA-98qh-xjc8-98pq	<26.6.1-r3
L GHSA-m4cv-j2px-7723	<26.6.1-r2
M CVE-2026-7500	<26.6.1-r2
C Improper Input Validation	<26.6.1-r2
L GHSA-xxqh-mfjm-7mv9	<26.6.1-r2
H HTTP Request Smuggling	<26.6.1-r2
L Resource Exhaustion	<26.6.1-r2
L GHSA-hm32-hfmw-rhvg	<26.6.1-r2
L GHSA-57rv-r2g8-2cj3	<26.6.1-r2
C HTTP Request Smuggling	<26.6.1-r2
L GHSA-45q3-82m4-75jr	<26.6.1-r2
L GHSA-v8h7-rr48-vmmv	<26.6.1-r2
L Resource Exhaustion	<26.6.1-r2
C HTTP Request Smuggling	<26.6.1-r2
L GHSA-38f8-5428-x5cv	<26.6.1-r2
L Missing Release of Resource after Effective Lifetime	<26.6.1-r2
L GHSA-mj4r-2hfc-f8p6	<26.6.1-r2
L Integer Overflow or Wraparound	<26.6.1-r2
L GHSA-cm33-6792-r9fm	<26.6.1-r2
L GHSA-rwm7-x88c-3g2p	<26.6.1-r2
H HTTP Response Splitting	<26.6.1-r2
L CRLF Injection	<26.6.1-r2
L GHSA-f6hv-jmp6-3vwv	<26.6.1-r2

Vulnerability

Vulnerable Version

Improper Handling of Alternate Encoding

<26.6.7-r3