A Resource Exhaustion vulnerability was found in Keycloaks theme resource endpoint (/resources/{version}/{themeType}/{themeName}/{path}). The root cause is improper validation of the themeName parameter when theme caching is enabled and the client requests gzip encoding. While the server resolves unknown theme names to a default theme, it uses the attacker-provided name to create a permanent file in the data/tmp/kc-gzip-cache/ directory. Because these entries are never expired or bounded, an unauthenticated remote attacker can send a high volume of requests with unique theme names to fill the servers disk. Successful exploitation leads to a persistent Denial of Service where legitimate theme assets return 404 errors and other disk-dependent operations, such as logging and transaction processing, fail.