ANALYSIS · 480bdafa · PATCHDIFF

keycloak26.6.5 → 26.6.6✓ COMPLETED

Started2026-09-07 06:06:20Z Finished2026-09-07 06:10:05Z Elapsed3m 45s

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-18963

FILTERS 0

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

2/44

All 44 CVE 2 Vuln 33

SORT

quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/tracing/SizeLimitedBaggagePropagatorCustomizer.java

AI: 1 vulnerabilities

customize CVE-2026-18963 1 TP

#005

server-spi-private/src/main/java/org/keycloak/models/AdminRoles.java

AI: 1 vulnerabilities

NO ENCLOSING FUNCTION CVE-2026-18963 1 TP

#013

1–2 of 2

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-18963

Security writeup for CVE-2026-18963

✓ 2 FILES

## The Exploit

An unauthenticated remote attacker can bypass the W3C Baggage specification 64 KiB size limit by sending an oversized `baggage` HTTP header, triggering denial of service or memory pressure on the Keycloak server.

```http
GET /auth/admin/realms HTTP/2
Host: target-keycloak-host
baggage: <PAYLOAD_OF_OVER_64_KILOBYTES_OF_PADDING>
```

When the request is processed, the server will consume excessive memory attempting to extract and propagate the baggage entry before the size limit check is applied. In high-throughput scenarios, repeated exploitation can cause the JVM to run out of heap space, leading to service unavailability.

## What the Patch Did

**Before** (vulnerable — the size-limited wrapper did not exist):

```java
// No SizeLimitedBaggagePropagatorCustomizer existed.
// The W3CBaggagePropagator was used directly with no size enforcement.
```

**After** (fixed):

```java
@Singleton
public class SizeLimitedBaggagePropagatorCustomizer implements TextMapPropagatorCustomizer {

@Override
    public TextMapPropagator customize(Context context) {
        TextMapPropagator propagator = context.propagator();
        if (propagator instanceof W3CBaggagePropagator) {
            return new SizeLimitedBaggagePropagator(propagator);
        }
        return propagator;
    }
}
```

The patch introduces a `TextMapPropagatorCustomizer` that replaces the vanilla `W3CBaggagePropagator` with a `SizeLimitedBaggagePropagator` wrapper. This is an input size validation control added at the OpenTelemetry context propagation boundary. The wrapper enforces the W3C Baggage specification's 64 KiB limit on the combined baggage header value before delegating extraction to the underlying propagator.

## Root Cause

The vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) lies in the absence of any size enforcement when Keycloak processes the `baggage` HTTP header via the OpenTelemetry SDK (versions <= 1.61.0). The dataflow is: attacker sends an HTTP request with a `baggage` header containing arbitrarily large data -> the Quarkus HTTP layer passes all headers to the OpenTelemetry `TextMapPropagator` -> the `W3CBaggagePropagator` iterates over baggage entries without checking cumulative header size -> each entry is parsed into heap-allocated objects. Because no trust boundary crosses between the untrusted HTTP header input and the internal propagation context, an attacker can send a payload that forces the server to allocate memory proportional to payload size, leading to denial of service. The `baggage` header parameter name is the sole attacker-controlled input.

## Why It Works

The single load-bearing line in the fix is the `instanceof W3CBaggagePropagator` check followed by wrapping it in `SizeLimitedBaggagePropagator`. If removed, the customizer would be a no-op and the vanilla (unbounded) propagator would remain in use, leaving the bug fully exploitable. The engineer added the guard clause (`if (!(propagator instanceof ...)) return propagator;`) for defensive programming: if future Quarkus versions replace the `W3CBaggagePropagator` with a different class, the customizer will not break the propagation chain by wrapping an incompatible propagator. The `@Singleton` annotation ensures only one instance is created, preventing a different class of resource leak. The `@Deprecated` removal in `AdminRoles.java` is an unrelated cleanup.

## Hardening Checklist

- **Enforce size limits on all untrusted HTTP headers at the proxy or servlet filter layer.** For OpenTelemetry baggage specifically, validate that the total `baggage` header value does not exceed 64 KiB before it reaches any parsing logic. The `HttpServletRequest.getHeader("baggage")` method returns the raw value — measure its length before any content processing.
- **Use a `javax.servlet.Filter` to reject oversize headers globally.** Register a filter with `@WebFilter("/*")` that calls `response.sendError(413, "Header Too Large")` if any single header exceeds 8 KiB or total header size exceeds 16 KiB, as recommended by the HTTP/1.1 specification (RFC 7230 Section 3.2.5).
- **Apply resource limits via the OpenTelemetry SDK configuration.** Upgrade to OpenTelemetry SDK 1.62.0+ which includes built-in baggage size limits. In the interim, set `-Dotel.baggage.maxSizeBytes=65536` if the SDK version supports it.
- **Enable JVM memory monitoring and alerting.** Configure `-XX:+HeapDumpOnOutOfMemoryError` and set heap usage alerts at 80% in your monitoring system (Prometheus/Grafana, New Relic) to catch resource exhaustion attacks early.
- **Unit test the propagator customizer.** Write a test that sends a `baggage` header of 65537 bytes and asserts that the server returns HTTP 413 or that the baggage is silently discarded, not parsed.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-45292
- https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0 (upstream fix)
- https://github.com/keycloak/keycloak/issues/49570 (vendor tracking issue)

CVE CVE-2026-18963

PRODUCT keycloak

AFFECTED ≤ 26.6.5

FIXED IN 26.6.6

STATUS Generated

Security writeup · CVE-2026-18963

Source files · 2

quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/tracing/SizeLimitedBaggagePropagatorCustomizer.java Linked

server-spi-private/src/main/java/org/keycloak/models/AdminRoles.java Linked

↗ NVD