CVE-2024-9666: Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-25 · updated 2026-09-21
Weakness: CWE-444

Description

A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service. The attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.

Affected products

Red Hat build of Keycloak 26.4: all versions — fixed in 24-18, 24.0.9-1, 26.0-5, 26.0-6, 26.0.6-2

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 24-18, 24.0.9-1, 26.0-5, 26.0-6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-9666 or the next vulnerability affects your stack