NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
MEDIUM severity

CVE-2024-9666 — keycloak-quarkus-server

MEDIUM

CVE-2024-9666 is a medium-severity (CVSS 4.7) CWE-444 vulnerability in org.keycloak:keycloak-quarkus-server. A fix is available for org.keycloak:keycloak-quarkus-server — see the affected versions and patch details below.

Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability

Also known asGHSA-jgwc-jh89-rpgq
Published
Updated
Affected
2 pkgs
Patched
1 / 2
Exploits
None indexed
Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-9666.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs35th percentile — riskier than 35% of all scored CVEsHighest risk
0.00%0.30%0.60%0.90%0.0%0.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected
☕org.keycloak:keycloak-quarkus-server☕org.keycloak:keycloak-quarkus-server

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Keycloak versions 26 and earlier are vulnerable to a denial-of-service (DoS) attack through improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service.

The attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.

For Keycloak version 26, for successful exploitation includes: the realm must have SslRequired=EXTERNAL (the default), HTTP must be enabled, the instance must not be using a full hostname URL, access must come from behind a proxy (assuming the proxy overwrites the X-Forwarded-For header), and trusted proxies must not be set or must incorrectly trust the client from which the request is originating.

Affected Packages

2 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.keycloak:keycloak-quarkus-serverall versionsNo fix
☕Mavenorg.keycloak:keycloak-quarkus-server≥ 25.0.0&&< 26.0.626.0.6org.keycloak:keycloak-quarkus-server:26.0.6

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.keycloak:keycloak-quarkus-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    A fix is available for CVE-2024-9666; check the affected-versions list above or the advisory for the patched release of org.keycloak:keycloak-quarkus-server, then make sure no transitive dependency still pins the vulnerable range.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatLow

Red Hat Enterprise Application Server 8 does not ship the affected component and so is not affected by this flaw.

Workaround published by Red Hat
Configure the reverse proxy to overwrite incoming proxy headers, including X-Forwarded-For, and ensure Keycloak trusts proxy headers only from the intended proxy rather than directly from untrusted clients. If proxy-header support is not required, disable acceptance of incoming proxy headers.
Source: Red Hat security advisory for CVE-2024-9666 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat build of Keycloak 24rhbk/keycloak-operator-bundle:24.0.9-1RHSA-2024:10175
Red Hat build of Keycloak 24.0.9see advisoryRHSA-2024:10176
Red Hat build of Keycloak 26.0rhbk/keycloak-operator-bundle:26.0.6-2RHSA-2024:10177
Red Hat build of Keycloak 26.0.6see advisoryRHSA-2024:10178

Frequently Asked Questions

Keycloak versions 26 and earlier are vulnerable to a denial-of-service (DoS) attack through improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service. The attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming
O3 Security · Impact-Aware SCA

Is CVE-2024-9666 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2024-9666: keycloak-quarkus DoS — Fixed in 26.0.6