New Red Hat build of Keycloak 26.2.5 packages are available from the Customer
 Portal

Red Hat build of Keycloak 26.2.5 is a standalone server, based on the Keycloak
 project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

Security fixes:
* XStream: XStream is vulnerable to a Denial of Service attack due to stack
 overflow from a manipulated binary input stream (CVE-2024-47072)
* Keycloak hostname verification (CVE-2025-3501)

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-47072: Deserialization of Untrusted Data (CWE-502)
CVE-2025-3501: Improper Validation of Certificate with Host Mismatch (CWE-297)