{"id":"ECHO-1ec0-58d1-cb3d","upstream":["CVE-2025-11537","GHSA-gv3v-2cpp-3pmq"],"severity":[],"modified":"2026-08-31T14:30:19.360Z","affected":[{"package":{"ecosystem":"Echo","name":"keycloak-25"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.6+e2"}]}]},{"package":{"ecosystem":"Echo:Maven","name":"org.keycloak:keycloak-quarkus-server","purl":"pkg:maven/org.keycloak/keycloak-quarkus-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2025-11537"}],"withdrawn":"2026-08-31T14:30:19.360Z","summary":"Keycloak's GHSA advisory (GHSA-gv3v-2cpp-3pmq) lists the affected\npackage/range as org.keycloak:keycloak-quarkus-server < 26.5.6 with no\nlower bound, so by version string alone 25.0.6 is nominally in range.\nThe actual vulnerable mechanism is the HTTP access log feature\n(config.HttpAccessLogOptions, HttpAccessLogPropertyMappers) added by\nthe fix commit's PR to mask Authorization/Cookie headers in a verbose\naccess-log pattern. That feature does not exist in 25.0.6 at all —\nconfirmed via a full source search (no HttpAccessLogOptions.java,\nHttpAccessLogPropertyMappers.java, or any http-access-log config\noption anywhere in quarkus/config-api or quarkus/runtime). There is no\naccess-log-pattern mechanism in this version capable of the described\nheader disclosure.\n"}