# Keycloak 26.7.4

> Security · 2026-09-16

A security-heavy maintenance release with vulnerability fixes, alongside correctness and performance corrections. It also updates the Quarkus dependency.

## Action needed
- **[security · high]** `CVE-2026-79651` and unbounded locale caching
  - `CVE-2026-79651` fixes an unauthenticated denial-of-service issue caused by unbounded locale caching. The fix ships in this release.
- **[security · high]** `CVE-2026-74909` and matrix parameter stripping
  - `CVE-2026-74909` completes the fix for a percent-encoded semicolon bypass of matrix parameter stripping in `PathMatcher`. The fix ships in this release.
- **[security · high]** `CVE-2026-17526` and the `impersonation` role
  - `CVE-2026-17526` fixes privilege escalation involving the `impersonation` role impersonating a realm administrator. The fix ships in this release.
- **[security · medium]** `CVE-2026-19607` and username takeover
  - `CVE-2026-19607` fixes a username takeover issue that could lead to account lockout. The fix ships in this release.

## Check if affected
- **[security · high]** `CVE-2026-18212` and SAML Redirect DEFLATE helpers
  - Applies if you use SAML Redirect.
  - `CVE-2026-18212` fixes native zlib state leaks in `SAML Redirect` DEFLATE helpers. The fix ships in this release.
- **[security]** `CVE-2026-90997` and stateless replay gate row counts
  - Applies if you use MySQL/MariaDB.
  - `CVE-2026-90997` fixes default `MySQL/MariaDB` row counts that let stateless replay gates accept reused artifacts. The fix ships in this release.

## Other recorded changes
- 6 (defect_corrected 5, value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/keycloak/26.7.4)

[Original release notes](https://github.com/keycloak/keycloak/releases/tag/26.7.4)