Bug 2523345 (CVE-2026-79651)
| Summary: | CVE-2026-79651 keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Deadline: | 2026-11-19 | ||
A flaw was found in Keycloak where the theme localization endpoints (/resources/master/common/{locale} and /admin/{realm}/console/messages.json) fail to validate or limit the locale tags provided in the request. Each unique locale tag results in a new entry being created in an unbounded in-memory cache within the theme message system. An unauthenticated remote attacker can exploit this by sending a high volume of HTTP GET requests containing unique BCP 47 locale tags. Because the cache is permanent and has no size limit, this leads to continuous heap memory consumption. Successful exploitation allows an attacker to exhaust the JVM heap memory, leading to an OutOfMemoryError and causing the Keycloak service to terminate, resulting in a complete denial of service.