What’s Vulnerable › Vulnerabilities

CVE-2025-2559: Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-25 · updated 2026-09-21
• Weakness: CWE-770

Description

A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.

Affected products

• Red Hat build of Keycloak 26.4: all versions — fixed in 26.0-12, 26.0-13, 26.0.11-2
• Red Hat Single Sign-On 7: all versions

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.0-12, 26.0-13, 26.0.11-2. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:4335
• https://access.redhat.com/errata/RHSA-2025:4336
• https://access.redhat.com/security/cve/CVE-2025-2559
• https://bugzilla.redhat.com/show_bug.cgi?id=2353868
• https://github.com/keycloak/keycloak/commit/a10c8119d4452b866b90a9019b2cc159919276ca
• https://github.com/keycloak/keycloak/issues/38576

Get alerted when CVE-2025-2559 or the next vulnerability affects your stack