wolfi/keycloak-config-cli

Vulnerabilities (18)

• CVE-2026-54517medJun 23, 2026
  affected < 6.5.1-r5fixed 6.5.1-r5

  ## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to creator properties; the regular property-buffering branch performed no `prop.visibleInView(activeView)` check. A change making `SetterlessProperty.isMerging()

• CVE-2026-54514medJun 23, 2026
  affected < 6.5.1-r5fixed 6.5.1-r5

  ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an `InetSocketAdd

• CVE-2026-54513higJun 23, 2026
  affected < 6.5.1-r5fixed 6.5.1-r5

  ## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without validating the array's component (element) type against the configured allowlist. A PTV built with `allowIfSubTypeIsArray()` plus an expli

• CVE-2026-54512higJun 23, 2026
  affected < 6.5.1-r5fixed 6.5.1-r5

  `jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains `<`), `DatabindContext._resolveAndVal

• CVE-2026-54518medJun 23, 2026
  affected < 6.5.1-r5fixed 6.5.1-r5

  ## Summary `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` replays buffered JSON into creator parameters but never consults `prop.visibleInView(activeView)`. The normal property-based creator path gates creator properties on the active view, but this unwrapped-crea

• CVE-2026-29062Mar 6, 2026
  affected < 6.5.1-r1fixed 6.5.1-r1

  jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNe

• CVE-2026-1225LowJan 22, 2026
  affected < 6.4.1-r7fixed 6.4.1-r7

  ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instanti

• CVE-2025-11226MedOct 1, 2025
  affected < 6.4.1-r7fixed 6.4.1-r7

  ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment varia

• CVE-2025-41249HigSep 16, 2025
  affected < 6.4.0-r49fixed 6.4.0-r49

  The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application m

• CVE-2025-7962Jul 21, 2025
  affected < 6.4.0-r48fixed 6.4.0-r48

  In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

• CVE-2025-48924Jul 11, 2025
  affected < 6.4.0-r45fixed 6.4.0-r45

  Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowErr

• CVE-2025-22233LowMay 16, 2025
  affected < 6.4.0-r42fixed 6.4.0-r42

  CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Sp

• CVE-2025-22235HigApr 28, 2025
  affected < 6.4.0-r51fixed 6.4.0-r51

  EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointR

• CVE-2025-22228HigMar 20, 2025
  affected < 6.4.0-r3fixed 6.4.0-r3

  BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

• CVE-2024-4028LowFeb 18, 2025
  affected < 6.4.0-r1fixed 6.4.0-r1

  A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.

• CVE-2024-10039higNov 25, 2024
  affected < 6.4.0-r1fixed 6.4.0-r1

  A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the a

• CVE-2024-7318Sep 9, 2024
  affected < 6.4.0-r1fixed 6.4.0-r1

  A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute

• CVE-2024-7260Sep 9, 2024
  affected < 6.4.0-r1fixed 6.4.0-r1

  An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe,