CVE-2025-11419: Keycloak TLS Client-Initiated Renegotiation Denial of Service

The vulnerability is a Denial of Service (DoS) vector in Keycloak's default configuration, stemming from the underlying Java Development Kit (JDK) allowing client-initiated renegotiation in TLS 1.2. An attacker can repeatedly send renegotiation requests, which are computationally expensive, leading to CPU exhaustion and service unavailability. The security patch addresses this by modifying the startup scripts (kc.sh and kc.bat) to include the Java system property -Djdk.tls.rejectClientInitiatedRenegotiation=true. This property instructs the JDK to reject such requests. As the vulnerability lies in the TLS protocol configuration at the JVM level and not within a specific application function, no vulnerable functions within the Keycloak codebase can be identified from the patch. The entire service is susceptible due to the environment's configuration. During an exploit, profiling would show high CPU usage in the JVM's internal TLS/SSL handling threads, not in specific Keycloak application logic.