What is the CVSS score of CVE-2026-9801?

CVE-2026-9801 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-9801?

Yes, a patch is available for CVE-2026-9801. Update the affected software to the latest version immediately.

Keycloak CVE-2026-9801

EUVD-2026-32718 MEDIUM

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-05-28 secalert@redhat.com

GHSA-f6r7-6w34-x2gp

Java Denial Of Service Build Of Keycloak

4.9

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Red Hat

4.9 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 06:32 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

33 maven packages depend on org.keycloak:keycloak-ldap-federation (5 direct, 28 indirect)

Ecosystem-wide dependent count for version 26.6.3.

DescriptionCVE.org

A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.

AnalysisAI

Denial of service in Keycloak's LDAP federation layer allows an authenticated realm administrator - or an attacker who has compromised an upstream LDAP server - to crash the entire Keycloak JVM by inducing an OutOfMemoryError through a malformed LDAP password policy response. Because Keycloak typically serves multiple realms from a single JVM process, a successful attack denies service to all realms on the affected node, not just the targeted one. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

Keycloak is Red Hat's open-source identity and access management platform that supports LDAP/Active Directory user federation, allowing it to delegate credential validation to upstream directory servers. During password authentication flows involving LDAP-federated realms, Keycloak processes LDAP password policy responses returned by the configured directory server. The root cause is CWE-1284 (Improper Validation of Specified Quantity in Input): Keycloak fails to validate or bound the quantity-type fields within incoming LDAP password policy responses, permitting a malformed response to drive unbounded heap allocation within the Keycloak JVM. Once the Java heap is exhausted, the JVM throws an unrecoverable OutOfMemoryError, terminating the process. No CPE strings were included in the available data; affected Keycloak versions must be confirmed via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9801. The Java tag in the report data confirms the attack surface is the JVM runtime environment.

RemediationAI

No specific patched version was identified in the available data. Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9801 and BZ#2482473 at https://bugzilla.redhat.com/show_bug.cgi?id=2482473 for patch availability and exact fix versions; apply any vendor-released update as the primary remediation once confirmed. As a compensating control for the direct admin attack path, audit and minimize the number of accounts holding realm administrator privileges, as PR:H is required. For the upstream LDAP compromise path, enforce LDAPS or StartTLS with strict certificate validation for all Keycloak-to-LDAP connections and restrict LDAP connectivity to managed, trusted infrastructure only - disabling certificate validation eliminates this protection entirely, a meaningful trade-off. Deploying Keycloak with realm-to-node isolation (dedicated nodes per high-value realm) reduces blast radius but does not eliminate exploitability on any individual node. Disabling LDAP federation for realms that do not require it removes the attack surface entirely but may break existing user federation workflows.