chainguard/request-9047-keycloak-fips-26.5-operator

Vulnerabilities (17)

• CVE-2026-54517medJun 23, 2026
  affected < 26.5.7-r9fixed 26.5.7-r9

  ## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to creator properties; the regular property-buffering branch performed no `prop.visibleInView(activeView)` check. A change making `SetterlessProperty.isMerging()

• CVE-2026-54516medJun 23, 2026
  affected < 26.5.7-r9fixed 26.5.7-r9

  ## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty("renamed")` on the getter and `@JsonIgnore` on the setter to be renamed rather than dropped. With `MapperFeature.INFER_PROPERTY_MUTATORS` enabled (default), the private backing field is

• CVE-2026-54514medJun 23, 2026
  affected < 26.5.7-r9fixed 26.5.7-r9

  ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an `InetSocketAdd

• CVE-2026-54513higJun 23, 2026
  affected < 26.5.7-r9fixed 26.5.7-r9

  ## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without validating the array's component (element) type against the configured allowlist. A PTV built with `allowIfSubTypeIsArray()` plus an expli

• CVE-2026-54512higJun 23, 2026
  affected < 26.5.7-r9fixed 26.5.7-r9

  `jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains `<`), `DatabindContext._resolveAndVal

• CVE-2026-54518medJun 23, 2026
  affected < 26.5.7-r9fixed 26.5.7-r9

  ## Summary `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` replays buffered JSON into creator parameters but never consults `prop.visibleInView(activeView)`. The normal property-based creator path gates creator properties on the active view, but this unwrapped-crea

• CVE-2026-48059HigJun 12, 2026
  affected < 26.5.7-r6fixed 26.5.7-r6

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid heade

• CVE-2026-48043MedJun 12, 2026
  affected < 26.5.7-r6fixed 26.5.7-r6

  Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedCh

• CVE-2026-47691HigJun 12, 2026
  affected < 26.5.7-r6fixed 26.5.7-r6

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an a

• CVE-2026-47244MedJun 12, 2026
  affected < 26.5.7-r6fixed 26.5.7-r6

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTING

• CVE-2026-45674HigJun 12, 2026
  affected < 26.5.7-r6fixed 26.5.7-r6

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Fina

• CVE-2026-45673MedJun 12, 2026
  affected < 26.5.7-r6fixed 26.5.7-r6

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination r

• CVE-2026-45416HigJun 12, 2026
  affected < 26.5.7-r6fixed 26.5.7-r6

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly all

• CVE-2026-44893HigJun 12, 2026
  affected < 26.5.7-r6fixed 26.5.7-r6

  Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex()

• CVE-2026-44249HigJun 11, 2026
  affected < 26.5.7-r6fixed 26.5.7-r6

  Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid pub

• CVE-2026-6860MedMay 6, 2026
  affected < 26.5.7-r3fixed 26.5.7-r3

  A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used.

• CVE-2026-39852HigMay 5, 2026
  affected < 26.5.7-r7fixed 26.5.7-r7

  Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged user