quay.io/keycloak/keycloak:26.6.3
Base OS: redhat 9.83 vulnerabilities fixed
Patched Image
ghcr.io/verity-org/keycloak/keycloak:26.6.3
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/keycloak/keycloak:26.6.3
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/keycloak/keycloak:26.6.3 \ --owner verity-org
Before patching
Found 86 vulnerabilities in the original image. 3 fixed by Copa. 83 remaining after patching.
17 HIGH47 MEDIUM22 LOW
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2025-59250HIGH
- Package
- com.microsoft.sqlserver:mssql-jdbc
- Installed
- 13.2.1
- Fixed
- 10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11
- CVE-2026-44893HIGH
- Package
- io.netty:netty-codec-haproxy
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-48059HIGH
- Package
- io.netty:netty-codec-haproxy
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-44249HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45416HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-50010HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45674HIGH
- Package
- io.netty:netty-resolver-dns
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-47691HIGH
- Package
- io.netty:netty-resolver-dns
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-9795HIGH
- Package
- org.keycloak:keycloak-services
- Installed
- 26.6.3
- Fixed
- 26.6.4
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2026-54516MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54516MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54517MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54517MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54518MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4
- CVE-2026-54518MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4
- CVE-2026-50020MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-47244MEDIUM
- Package
- io.netty:netty-codec-http2
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-48043MEDIUM
- Package
- io.netty:netty-codec-http2
- Installed
- 4.1.133.Final
- Fixed
- 4.1.135.Final, 4.2.15.Final
- CVE-2026-50560MEDIUM
- Package
- io.netty:netty-codec-http2
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45673MEDIUM
- Package
- io.netty:netty-resolver-dns
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45536MEDIUM
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45536MEDIUM
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.1.133.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45292MEDIUM
- Package
- io.opentelemetry:opentelemetry-api
- Installed
- 1.57.0
- Fixed
- 1.62.0
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| CVE-2025-59250 | com.microsoft.sqlserver:mssql-jdbc | 13.2.1 | 10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11 | HIGH |
| CVE-2026-44893 | io.netty:netty-codec-haproxy | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-48059 | io.netty:netty-codec-haproxy | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-44249 | io.netty:netty-handler | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-45416 | io.netty:netty-handler | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-50010 | io.netty:netty-handler | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-45674 | io.netty:netty-resolver-dns | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-47691 | io.netty:netty-resolver-dns | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-9795 | org.keycloak:keycloak-services | 26.6.3 | 26.6.4 | HIGH |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2026-54516 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54516 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54517 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54517 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54518 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4 | MEDIUM |
| CVE-2026-54518 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4 | MEDIUM |
| CVE-2026-50020 | io.netty:netty-codec-http | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-47244 | io.netty:netty-codec-http2 | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-48043 | io.netty:netty-codec-http2 | 4.1.133.Final | 4.1.135.Final, 4.2.15.Final | MEDIUM |
| CVE-2026-50560 | io.netty:netty-codec-http2 | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45673 | io.netty:netty-resolver-dns | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45536 | io.netty:netty-transport-native-epoll | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45536 | io.netty:netty-transport-native-epoll | 4.1.133.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45292 | io.opentelemetry:opentelemetry-api | 1.57.0 | 1.62.0 | MEDIUM |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2025-66293HIGH
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-22020HIGH
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-25646HIGH
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-54369HIGH
- Package
- libacl
- Installed
- 2.3.1-4.el9
- Fixed
- CVE-2026-5435MEDIUM
- Package
- glibc
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5928MEDIUM
- Package
- glibc
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-6238MEDIUM
- Package
- glibc
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5435MEDIUM
- Package
- glibc-common
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5928MEDIUM
- Package
- glibc-common
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-6238MEDIUM
- Package
- glibc-common
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5435MEDIUM
- Package
- glibc-langpack-en
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5928MEDIUM
- Package
- glibc-langpack-en
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-6238MEDIUM
- Package
- glibc-langpack-en
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2025-28164MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2025-64505MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2025-64506MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-22693MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-22695MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-22801MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-33416MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-33636MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-34757MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-41254MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-54370MEDIUM
- Package
- libacl
- Installed
- 2.3.1-4.el9
- Fixed
- CVE-2026-54371MEDIUM
- Package
- libattr
- Installed
- 2.5.1-3.el9
- Fixed
- CVE-2026-13757MEDIUM
- Package
- p11-kit-trust
- Installed
- 0.26.2-1.el9
- Fixed
- CVE-2026-5958MEDIUM
- Package
- sed
- Installed
- 4.8-10.el9
- Fixed
- CVE-2026-9689MEDIUM
- Package
- org.keycloak:keycloak-services
- Installed
- 26.6.3
- Fixed
- CVE-2026-9793MEDIUM
- Package
- org.keycloak:keycloak-services
- Installed
- 26.6.3
- Fixed
- CVE-2026-9798MEDIUM
- Package
- org.keycloak:keycloak-services
- Installed
- 26.6.3
- Fixed
- CVE-2026-27171LOW
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2021-46195LOW
- Package
- libgcc
- Installed
- 11.5.0-14.el9
- Fixed
- CVE-2022-27943LOW
- Package
- libgcc
- Installed
- 11.5.0-14.el9
- Fixed
- CVE-2023-50495LOW
- Package
- ncurses-base
- Installed
- 6.2-12.20210508.el9
- Fixed
- CVE-2023-50495LOW
- Package
- ncurses-libs
- Installed
- 6.2-12.20210508.el9
- Fixed
- CVE-2020-12413LOW
- Package
- nspr
- Installed
- 4.36.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nspr
- Installed
- 4.36.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss-softokn
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss-softokn
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss-softokn-freebl
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss-softokn-freebl
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss-sysinit
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss-sysinit
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss-util
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss-util
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2022-41409LOW
- Package
- pcre2
- Installed
- 10.40-6.el9
- Fixed
- CVE-2022-41409LOW
- Package
- pcre2-syntax
- Installed
- 10.40-6.el9
- Fixed
- CVE-2024-0232LOW
- Package
- sqlite-libs
- Installed
- 3.34.1-10.el9_8
- Fixed
- CVE-2025-70873LOW
- Package
- sqlite-libs
- Installed
- 3.34.1-10.el9_8
- Fixed
- CVE-2026-27171LOW
- Package
- zlib
- Installed
- 1.2.11-40.el9
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2025-66293 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | HIGH | |
| CVE-2026-22020 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | HIGH | |
| CVE-2026-25646 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | HIGH | |
| CVE-2026-54369 | libacl | 2.3.1-4.el9 | HIGH | |
| CVE-2026-5435 | glibc | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5928 | glibc | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-6238 | glibc | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5435 | glibc-common | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5928 | glibc-common | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-6238 | glibc-common | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5435 | glibc-langpack-en | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5928 | glibc-langpack-en | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-6238 | glibc-langpack-en | 2.34-272.el9_8 | MEDIUM | |
| CVE-2025-28164 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2025-64505 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2025-64506 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-22693 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-22695 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-22801 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-33416 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-33636 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-34757 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-41254 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-54370 | libacl | 2.3.1-4.el9 | MEDIUM | |
| CVE-2026-54371 | libattr | 2.5.1-3.el9 | MEDIUM | |
| CVE-2026-13757 | p11-kit-trust | 0.26.2-1.el9 | MEDIUM | |
| CVE-2026-5958 | sed | 4.8-10.el9 | MEDIUM | |
| CVE-2026-9689 | org.keycloak:keycloak-services | 26.6.3 | MEDIUM | |
| CVE-2026-9793 | org.keycloak:keycloak-services | 26.6.3 | MEDIUM | |
| CVE-2026-9798 | org.keycloak:keycloak-services | 26.6.3 | MEDIUM | |
| CVE-2026-27171 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | LOW | |
| CVE-2021-46195 | libgcc | 11.5.0-14.el9 | LOW | |
| CVE-2022-27943 | libgcc | 11.5.0-14.el9 | LOW | |
| CVE-2023-50495 | ncurses-base | 6.2-12.20210508.el9 | LOW | |
| CVE-2023-50495 | ncurses-libs | 6.2-12.20210508.el9 | LOW | |
| CVE-2020-12413 | nspr | 4.36.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nspr | 4.36.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss | 3.112.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss-softokn | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss-softokn | 3.112.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss-softokn-freebl | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss-softokn-freebl | 3.112.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss-sysinit | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss-sysinit | 3.112.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss-util | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss-util | 3.112.0-8.el9_4 | LOW | |
| CVE-2022-41409 | pcre2 | 10.40-6.el9 | LOW | |
| CVE-2022-41409 | pcre2-syntax | 10.40-6.el9 | LOW | |
| CVE-2024-0232 | sqlite-libs | 3.34.1-10.el9_8 | LOW | |
| CVE-2025-70873 | sqlite-libs | 3.34.1-10.el9_8 | LOW | |
| CVE-2026-27171 | zlib | 1.2.11-40.el9 | LOW |
Original image reference
quay.io/keycloak/keycloak:26.6.3