Keycloak Cluster on Three VMs: Engineers Detail Embedded Infinispan Setup, HA Testing Failures, and Bug Fix
A project required centralized authentication and authorization for 25,000–30,000 active users distributed nationwide, demanding strong scalability and reliability. The team selected Keycloak and rejected a single instance because it could not meet throughput or SLA targets. They therefore built a three-node cluster on isolated virtual machines using Embedded Infinispan and JGroups.
Kubernetes was considered excessive for the environment. The chosen architecture placed each Keycloak node in a separate data center, shared a PostgreSQL database clustered with Patroni, and enabled cache mode ispn so sessions replicate across nodes. TCP ports 7800 and 57800 were opened between the VMs for Infinispan communication and failure detection.
Each node registers its address in the JGROUPS_PING table at startup, allowing dynamic membership without static TCPPING lists. The JVM flag -Djgroups.external_addr and explicit node-name entries in cache-ispn.xml ensured correct visibility of external IPs and hostnames across data centers.
Failover tests included node restarts, database connectivity loss, and complete data-center isolation. When only Keycloak nodes lost connectivity while the database remained reachable, the cluster recovered automatically. Full data-center outages, however, produced split-brain states, multiple coordinators, and persistent 5xx errors. The built-in healthcheck did not detect the condition even after an upgrade that added cluster-specific checks.
A temporary Python watcher was deployed beside each container. It polled health endpoints and the JGROUPS_PING table, restarting any node that appeared as an extra coordinator. The root cause was reported in GitHub issue 45980; Keycloak developers acknowledged the bug and shipped a fix. After verification on test and staging environments, the production cluster was updated and now tolerates single data-center failure without session loss.
Related articles
From UDP Probe to Working Tunnel: Analyzing Hysteria2 Behavior via QUIC, HTTP/3 and Client Events
A detailed technical study examined how commercial Hysteria2 VPN endpoints respond to different levels of network probing, starting from simple UDP packets and progressing to full QUIC handshakes and authenticated client connections. The research used custom NetProbe tools on Windows and Linux to test real subscription endpoints, capturing both external probe results and decrypted traffic from an instrumented Hysteria2 client. Simple UDP probes received no response and timed out, while properly formed QUIC Initial packets with TLS ClientHello and ALPN h3 successfully completed handshakes using TLS 1.3 and TLS_AES_256_GCM_SHA384. An unauthenticated HTTP/3 GET request triggered immediate connection closure with H3_NO_ERROR (code 0x100), whereas a legitimate client sending POST /auth with Hysteria-Auth headers received the expected 233 status confirming authentication and UDP forwarding support. Subsequent data transfer tests, including parallel requests and file downloads, were observed inside separate QUIC streams after authentication, confirming that the tunnel carried real traffic. The study highlights differences between external probing and authenticated client behavior, providing practical insight into how Hysteria2 servers handle reconnaissance versus legitimate VPN usage.
Unbound 1.26.1 Patches Critical DNSSEC Validator Flaw CVE-2026-81642 Enabling Remote Code Execution
NLnet Labs has released Unbound 1.26.1 to address CVE-2026-81642, a critical vulnerability in the DNSSEC validator that can cause service crashes and potential remote code execution. The flaw affects all versions up to and including 1.26.0 and is triggered when validating a malicious DNS zone. It resides in the handling of DNSKEY records, where a buffer overflow can occur during DNS response processing. The vulnerability carries a CVSS 4.0 score of 9.1 with a network attack vector, no privileges required, and no user interaction needed. Exploitation requires an attacker to control a malicious DNS zone that the resolver queries, which can lead to denial of service or RCE in the worst case. The update also includes fixes for eight additional security issues, including CVE-2026-82717 and CVE-2026-81634, both involving heap corruption.
BIND DNS Servers Receive Patches for 14 Vulnerabilities Including High-Severity DoS Flaws
The Internet Systems Consortium has released BIND 9 updates that address 14 vulnerabilities across multiple versions of the widely used DNS server software. Seven of the issues received a CVSS score of 7.5 and were rated high severity, while the remaining seven scored between 5.3 and 6.5. The most critical flaw allows an unauthenticated attacker to crash the named process with a single malformed SIG(0) request over DNS over HTTPS. Additional vulnerabilities enable cache poisoning through forged NXDOMAIN responses, downgraded secure delegations, and acceptance of unsigned answers, as well as resource exhaustion via uncontrolled cache growth and excessive CPU consumption. Affected releases span BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25. No workarounds exist, making immediate upgrades to versions 9.20.29, 9.21.26, or 9.20.29-S1 the only mitigation. The ISC reports no known exploitation in the wild and none of the flaws appear in CISA’s Known Exploited Vulnerabilities catalog.
Cisco Patches 29 Vulnerabilities in Secure Firewall ASA, FTD and FMC Products
Cisco Systems has disclosed multiple vulnerabilities affecting its Cisco Secure Firewall product line and released corresponding security updates. The advisory covers 14 security bulletins addressing 29 CVEs across Adaptive Security Appliance (ASA), Threat Defense (FTD), and Management Center (FMC) software. Five of the advisories are rated Critical, covering 18 CVEs that include remote code execution without authentication and privilege escalation to administrator level. Several issues have already been confirmed as exploited in the wild. The company also consolidated related weaknesses under single CVE identifiers where appropriate and provided CVSS v3.1 base scores ranging up to 9.9. Affected products include the Secure Firewall 3100 and 4200 Series along with multiple software hardening releases issued on 16 September 2026.