CVE-2025-2559
No fix known EPSS <1%CVSS 4.9
A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.
Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 26.0, Red Hat Single Sign-On 7
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak | no fix |
| Wolfi | keycloak | no fix |