{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/keycloak/keycloak","packageName":"keycloak","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"24.0.9","status":"affected","version":"0","versionType":"semver"},{"lessThan":"26.0.6","status":"affected","version":"25.0.0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 24","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"24.0.9-1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 24","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"24-18","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 24","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"24-18","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","product":"Red Hat build of Keycloak 24.0.9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.0","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.0.6-2","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.0","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.0-5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.0","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.0-6","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","product":"Red Hat build of Keycloak 26.0.6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-quarkus-server","product":"Red Hat Build of Keycloak","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"keycloak-quarkus-server","product":"Red Hat JBoss Enterprise Application Platform 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2024-9666","cwes":["CWE-444"],"description":"A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service.\nThe attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.","epss":{"date":"2026-11-02","percentile":0.34517,"score":0.00403},"exploits":[],"kev":null,"metrics":[{"score":4.7,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793698256413,"publishedAt":1732519792073,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:10175"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:10176"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:10177"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:10178"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2024-9666"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317440"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Configure the reverse proxy to overwrite incoming proxy headers, including X-Forwarded-For, and ensure Keycloak trusts proxy headers only from the intended proxy rather than directly from untrusted clients. If proxy-header support is not required, disable acceptance of incoming proxy headers."}],"revision":"a68857133dbe28d343db79838cc8ba06be51c3a43d42ecec0e0be52c030ffb78","sources":[{"modifiedAt":1793698256413,"name":"CNA: redhat","retrievedAt":1793700501236,"url":"https://www.cve.org/CVERecord?id=CVE-2024-9666"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793700530388,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9666"}],"ssvc":{"assessedAt":1732554895721,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability","updatedAt":1793700530388}