Skip to content

[26.4] CVE-2026-45292: size-limiting baggage propagator wrapper#51097

Open
Pepo48 wants to merge 2 commits into
keycloak:release/26.4from
Pepo48:backport-49570-26.4
Open

[26.4] CVE-2026-45292: size-limiting baggage propagator wrapper#51097
Pepo48 wants to merge 2 commits into
keycloak:release/26.4from
Pepo48:backport-49570-26.4

Conversation

@Pepo48

@Pepo48 Pepo48 commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Closes: #49570

Cherry-picked from: 9bb7a95

Edit:
It needed to be adapted for OTel 1.44.x (Quarkus 3.27) that is used in 26.4. It uses getter.get() instead of getAll(), which is not available in that OTel version. This provides equivalent protection because OTel 1.44.x's W3CBaggagePropagator itself only reads a single header via get() (multi-header support was added in OTel 1.45.0). See the changes in the separate commit.

@Pepo48
CVE-2026-45292: size-limiting baggage propagator wrapper
cb032b5 
Closes: keycloak#49570

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
@Pepo48
Pepo48 requested review from a team as code owners July 22, 2026 17:07
@Pepo48 Pepo48 changed the title CVE-2026-45292: size-limiting baggage propagator wrapper [26.4] CVE-2026-45292: size-limiting baggage propagator wrapper Jul 22, 2026
@keycloak-github-bot

keycloak-github-bot Bot commented Jul 23, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.AuthenticatorSubflowsTest2#testSubflow2

Keycloak CI - Forms IT (chrome)

java.lang.AssertionError: Expected AppPage but was PushTheButton (https://localhost:8543/auth/realms/test/login-actions/authenticate?execution=00f1fc4b-3486-48b1-ab12-a9cfe3eb3d4c&client_id=test-app&tab_id=beoy6qT-iOo&client_data=eyJydSI6Imh0dHBzOi8vbG9jYWxob3N0Ojg1NDMvYXV0aC9yZWFsbXMvbWFzdGVyL2FwcC9hdXRoIiwicnQiOiJjb2RlIn0)
	at org.junit.Assert.fail(Assert.java:89)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:38)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test13_registrationWithDefaultGroupsAndDeferredLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test13_registrationWithDefaultGroupsAndDeferredLdapCreation(LDAPGroupMapperTest.java:1080)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test14_registrationWithDefaultGroupsAndImmediateLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test14_registrationWithDefaultGroupsAndImmediateLdapCreation(LDAPGroupMapperTest.java:1089)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.noimport.LDAPGroupMapperNoImportTest#test13_registrationWithDefaultGroupsAndDeferredLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test13_registrationWithDefaultGroupsAndDeferredLdapCreation(LDAPGroupMapperTest.java:1080)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.noimport.LDAPGroupMapperNoImportTest#test14_registrationWithDefaultGroupsAndImmediateLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test14_registrationWithDefaultGroupsAndImmediateLdapCreation(LDAPGroupMapperTest.java:1089)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 23, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

vmuzikar
vmuzikar reviewed Jul 24, 2026
View reviewed changes
Comment thread ...runtime/src/main/java/org/keycloak/quarkus/runtime/tracing/SizeLimitedBaggagePropagator.java
}

// Uses get() instead of getAll() (added in OTel 1.45.0) — equivalent protection since
// OTel 1.44.x propagator itself only reads a single header

@vmuzikar vmuzikar Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it mean it only reads the first one?

In any case, we should probably keep some tests for when there are multiple headers to check it behaves as expected.

@Pepo48 Pepo48 Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, get() returns only the first value. I tried to explain it more in the description.

I added some more test cases - to check that second header is ignored, only first is parsed; to check whether oversized first header is blocked as expected to check that oversized second header doesn't matter since only the first is read.

@vmuzikar
vmuzikar requested a review from Copilot July 24, 2026 16:08
Copilot AI reviewed Jul 24, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@vmuzikar
vmuzikar requested a review from Copilot July 24, 2026 16:23
Copilot AI reviewed Jul 24, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@Pepo48
CVE-2026-45292: size-limiting baggage propagator wrapper
4e147ab 
* adapt baggage propagator wrapper for OTel 1.44.x

Closes: keycloak#49570

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
@Pepo48
Pepo48 force-pushed the backport-49570-26.4 branch from 3ffb973 to 4e147ab Compare July 24, 2026 16:37
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 24, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 24, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.RPInitiatedFrontChannelLogoutTest#testFrontChannelLogoutWithoutSessionRequired

Keycloak CI - Forms IT (firefox)

org.openqa.selenium.TimeoutException: 
Navigation timed out after 10000 ms
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
...

Report flaky test

org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test13_registrationWithDefaultGroupsAndDeferredLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test13_registrationWithDefaultGroupsAndDeferredLdapCreation(LDAPGroupMapperTest.java:1080)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test14_registrationWithDefaultGroupsAndImmediateLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test14_registrationWithDefaultGroupsAndImmediateLdapCreation(LDAPGroupMapperTest.java:1089)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.noimport.LDAPGroupMapperNoImportTest#test13_registrationWithDefaultGroupsAndDeferredLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test13_registrationWithDefaultGroupsAndDeferredLdapCreation(LDAPGroupMapperTest.java:1080)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.noimport.LDAPGroupMapperNoImportTest#test14_registrationWithDefaultGroupsAndImmediateLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test14_registrationWithDefaultGroupsAndImmediateLdapCreation(LDAPGroupMapperTest.java:1089)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vmuzikar vmuzikar vmuzikar left review comments
Copilot code review Copilot Copilot left review comments
+1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

flaky-test team/cloud-native

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Pepo48 @vmuzikar