What is the CVSS score of CVE-2026-9803?

CVE-2026-9803 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-9803?

Yes, a patch is available for CVE-2026-9803. Update the affected software to the latest version immediately.

Keycloak CVE-2026-9803

EUVD-2026-32719 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-28 secalert@redhat.com

GHSA-cpf7-j4cf-vqx4

Information Disclosure Denial Of Service Buffer Overflow Build Of Keycloak

5.3

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 06:32 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

50 maven packages depend on org.keycloak:keycloak-services (22 direct, 28 indirect)

Ecosystem-wide dependent count for version 26.5.0.

DescriptionCVE.org

A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service.

AnalysisAI

Keycloak's ClientRegistrationAuth component can be crashed by a remote unauthenticated attacker through a specially crafted POST request bearing a malformed 'Authorization: Bearer' header, triggering an unhandled ArrayIndexOutOfBoundsException and returning HTTP 500 to all subsequent callers of the affected endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero prerequisites for exploitation beyond network reachability, making any publicly exposed Keycloak client registration endpoint a viable target. No public exploit has been identified at time of analysis and no EPSS data was supplied, but the trivial attack mechanics mean no specialized tooling is required to reproduce the denial of service.

Technical ContextAI

Keycloak is a widely-deployed open-source identity and access management platform commonly used for OAuth 2.0, OpenID Connect, and SAML federation. The ClientRegistrationAuth component governs authentication checks on the Dynamic Client Registration API endpoints (typically at /realms/{realm}/clients-registrations/...). The root cause is CWE-125 (Out-of-bounds Read): in the Java runtime, this manifests as an ArrayIndexOutOfBoundsException when header-parsing logic attempts to access an index beyond array bounds on a truncated or structurally incomplete Bearer token string - for example, a header value of 'Bearer' with no trailing token. Java does not allow memory corruption on out-of-bounds access, so the result is a thrown exception rather than heap corruption; however, if the exception propagates unhandled through the request lifecycle it terminates the HTTP response with a 500 status and renders the endpoint dysfunctional for the request duration. No CPE strings were included in the provided intelligence; exact affected Keycloak versions must be sourced from the Red Hat advisory. The 'Buffer Overflow' tag in the source data is technically inaccurate for a managed Java runtime - the underlying mechanism is array index miscalculation, consistent with CWE-125, not a native memory buffer overwrite.

RemediationAI

No specific patched version was confirmed in the available input data; organizations should monitor https://access.redhat.com/security/cve/CVE-2026-9803 and https://bugzilla.redhat.com/show_bug.cgi?id=2482465 for patch releases and apply vendor-issued updates as soon as they become available. As an effective compensating control, disable Dynamic Client Registration entirely within each Keycloak realm via the admin console (Realm Settings → Client Registration → Disable) if the feature is not operationally required - this eliminates the vulnerable code path with no impact on standard authentication or token issuance flows. If dynamic registration must remain enabled, restrict network access to the /realms/*/clients-registrations/* path prefix at the reverse proxy or WAF layer to trusted management networks only, directly neutralizing the unauthenticated attack vector; note that this requires accurate network segmentation and does not address the underlying defect. Input validation at the WAF level to reject malformed Authorization headers is a lower-confidence secondary control, as header normalization behavior varies by proxy implementation.