A flaw was found in Keycloak where the theme localization endpoints (/resources/master/common/{locale} and /admin/{realm}/console/messages.json) fail to validate or limit the locale tags provided in the request. Each unique locale tag results in a new entry being created in an unbounded in-memory cache within the theme message system.
An unauthenticated remote attacker can exploit this by sending a high volume of HTTP GET requests containing unique BCP 47 locale tags. Because the cache is permanent and has no size limit, this leads to continuous heap memory consumption. Successful exploitation allows an attacker to exhaust the JVM heap memory, leading to an OutOfMemoryError and causing the Keycloak service to terminate, resulting in a complete denial of service.