Releases

Action needed (3)

• securitymediumCVE-2025-67735 in netty-codec-http

  CVE-2025-67735 addresses request smuggling via CRLF injection in netty-codec-http. The fix ships in Keycloak 26.5.2.

• securitymediumCVE-2025-66560 in io.quarkus/quarkus-rest

  CVE-2025-66560 addresses the Quarkus REST worker thread exhaustion vulnerability in io.quarkus/quarkus-rest. The fix ships in Keycloak 26.5.2.

• securitymediumCVE-2025-14559 in keycloak-services

  CVE-2025-14559 addresses a business logic flaw in keycloak-services that allowed unauthorized token issuance for disabled users. The fix ships in Keycloak 26.5.2.

Check if affected (2)

• securityDragonfly manager job API unauthenticated access fix

  Applies if you use Dragonfly manager job API.

• breakingDeprecated preheat API endpoints removed

  Applies if you use deprecated preheat API endpoints.

Action needed (1)

• securityThe nvidia-mig-parted dependency, upgraded to v0.12.2

  HAMi v2.8.0 upgrades the nvidia-mig-parted dependency to v0.12.2 to address security issues.

Action needed (1)

• securityhighCVE-2025-68119 fix

  The release also addresses CVE-2025-68119, which affects the stated Go versions.

Check if affected (1)

• securityThe Organization feature account-name exposure fix

  Applies if you use the Organization feature.

Check if affected (2)

• securityBrute force detection settings vulnerability, corrected

  Applies if you configure brute force detection settings.

• breakingPostgreSQL 13.x support removal

  Applies if you depend on PostgreSQL 13.x.

Action needed (1)

• securityhighgolang-jwt update for CVE-2025-30204

  Notary v1.3.2 updates the golang-jwt dependency to address CVE-2025-30204.