EUVD-2026-80830
GHSA-8qv5-pjhw-3gx4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing Keycloak endpoint
-
DeliverySend unauthenticated theme localization request
-
ExploitSupply large volume of unique locale tags
-
ExecutionUnbounded cache grows without limit
-
PersistServer heap exhausted (OOM)
-
ImpactKeycloak crashes, SSO/auth outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to Keycloak's theme localization endpoints (part of the keycloak-services authentication component); no authentication, credentials, or user interaction are needed. The single functional prerequisite is that the vulnerable, unpatched version is deployed and the localization endpoint is reachable by the attacker. Limiting factors: instances not exposed to untrusted networks (internal-only, behind a WAF/rate-limiter, or fronted by a proxy that rejects malformed/high-cardinality locale parameters) sharply reduce practical risk, and adequate JVM heap plus request rate-limiting raises the volume of unique tags needed to force OOM. Impact is availability-only - no data disclosure or integrity compromise. |
| Impact | This is a genuine, well-formed unauthenticated remote denial-of-service. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: a network-reachable theme localization endpoint accepts arbitrary locale tags from unauthenticated clients and caches them permanently without bound (CWE-400), so an attacker can drive the JVM to OutOfMemory and crash the server. Unlike many high-CVSS records, there is NO signal conflict here - the vector's C:N/I:N/A:H matches a pure availability/resource-exhaustion flaw, and the 7.5 reflects availability-only impact rather than being inflated toward critical. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation; risk is currently theoretical-but-practical. The real-world priority is moderate-to-elevated: exploitation is trivial (single-condition, no auth, no user interaction, scriptable flood of unique locale strings) and Keycloak is a high-value identity/SSO chokepoint whose outage cascades to every application relying on it for login. Confirmed patches exist (multiple RHSA errata), which should drive prompt remediation for internet-exposed Keycloak instances. |
| Exploit ScenarioDerived | An unauthenticated attacker on the network repeatedly calls the Keycloak theme localization endpoint with a large stream of unique locale tags (e.g. randomized language/region strings). Each unseen tag is added to an unbounded permanent in-memory cache; sustained traffic exhausts heap memory and crashes the Keycloak server, breaking authentication for all dependent applications. No public exploit code is identified, but the attack is trivially scriptable given the AV:N/AC:L/PR:N/UI:N vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote memory exhaustion in Keycloak's theme localization endpoints allows any network-reachable attacker to crash the server by flooding the keycloak-services component with unique locale tags, each of which is retained indefinitely in an unbounded in-memory cache. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments where those endpoints are exposed to untrusted networks, and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5, CWE-400). Impact is availability-only with no data disclosure or integrity compromise, and no public exploit code has been identified at time of analysis, nor is there confirmed active exploitation (CISA KEV).
RemediationAI
Patch available per vendor advisory: Red Hat has published errata RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278 and RHSA-2026:68280 for CVE-2026-79651, so upgrade Red Hat Build of Keycloak and Red Hat Single Sign-On 7 to the fixed build listed in the errata matching your release stream, verifying the exact version at https://access.redhat.com/security/cve/CVE-2026-79651 since no precise patched version number is given in the available data. If patching must be deferred, the most effective compensating control is to prevent untrusted traffic from reaching the theme localization endpoint: block or restrict the theme resource/localization path at the reverse proxy, WAF or ingress (side effect: breaks legitimate multi-locale theme rendering for external users and any custom locales), or apply strict rate limiting and maximum-length validation on the locale query parameter so that high-cardinality or malformed tags are rejected before they reach the cache (side effect: legitimate clients sending unusual but valid tags may be throttled and need allow-listing). Deploying the service only on internal networks or behind an authenticating proxy removes the unauthenticated attack surface entirely (side effect: breaks public-facing login/theme rendering). Increasing JVM heap and alerting on heap growth or locale-cache cardinality can raise the volume of unique tags required to force OOM and provide early warning, but this only buys time and does not remove the unbounded cache, so treat it as a stopgap alongside patching.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable logic sits in keycloak-services, the core Keycloak module that drives authentication flows, realm/theme resolution and theme resource serving. Theme localization works by taking the locale parameter supplied on an unauthenticated HTTP request and resolving it against available message bundles; the resolved locale data is then placed into a JVM-wide in-memory cache. That cache has no cardinality or size bound and the locale tag is not validated against the set of locales actually configured for the realm or theme, so every distinct attacker-chosen tag creates a new, permanently retained entry. This is a textbook CWE-400 (Uncontrolled Resource Consumption): sustained requests carrying high-cardinality or arbitrarily long locale tags progressively consume heap until the JVM raises OutOfMemoryError and the service stops responding. CPE data attributes the issue to red_hat:red_hat_build_of_keycloak across multiple release streams and to red_hat:red_hat_single_sign-on_7; the underlying code path is shared with upstream Keycloak distributions built from the same keycloak-services component.
Know when Red Hat Build Of Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable endpoint with trivial complexity and no interaction (AV:N/AC:L/PR:N/UI:N); unbounded cache causes memory-exhaustion crash, so availability-only (A:H, C:N/I:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.
Executive ViewAI
Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that expose theme localization endpoints to untrusted networks are vulnerable to an unauthenticated remote memory exhaustion attack that can crash the authentication server. Because these products often serve as the central identity provider, a successful denial-of-service can disrupt login and access to downstream applications for all users, making this a high-priority availability risk for security and operations leadership. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to theme localization endpoints, applying rate limiting and WAF rules to block excessive unique locale tags, monitoring memory usage, and preparing rapid restart/failover procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Exploit-DB