CVE-2025-3501
Fixed in a distro release EPSS <1%CVSS 8.2
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 26, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.2, Red Hat Single Sign-On 7
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.2.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-bitnami-fips | 26.2.2-r0 |
| Chainguard | keycloak-fips | 26.2.2-r0 |
| Chainguard | keycloak-fips-bitnami-compat | 26.2.2-r0 |
| Chainguard | keycloak-fips-policy-140-2 | 26.2.2-r0 |
| Chainguard | keycloak-fips-policy-140-3 | 26.2.2-r0 |
| Chainguard | keycloak-iamguarded-fips | 26.2.2-r0 |