CVE-2026-79651: Keycloak Services DOS Vulnerability

CVE-2026-79651 Overview

CVE-2026-79651 is a resource exhaustion vulnerability in the keycloak-services component of Keycloak. The keycloak-services module handles authentication flows and theme management. The theme localization endpoints accept arbitrary locale tags from unauthenticated requests and store them in an unbounded in-memory cache. An attacker can send a large number of unique locale tags to exhaust server memory and crash the Keycloak instance. The flaw is tracked as an uncontrolled resource consumption issue [CWE-400] and affects availability of authentication services.

Critical Impact
Unauthenticated attackers can crash Keycloak servers remotely by triggering memory exhaustion through the theme localization endpoints, disrupting all authentication flows dependent on the identity provider.

Affected Products

Red Hat build of Keycloak (see RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278, RHSA-2026:68280)
Keycloak keycloak-services component
Downstream distributions embedding vulnerable Keycloak releases

Discovery Timeline

2026-09-16 - CVE-2026-79651 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-79651

Vulnerability Analysis

The vulnerability resides in the theme localization endpoints exposed by the keycloak-services component. These endpoints serve translated messages for login pages, account consoles, and administrative themes based on a locale parameter supplied in the request. The endpoints are reachable without authentication because localization must be resolved before a user completes login.

When a request arrives, Keycloak parses the supplied locale tag and stores the corresponding resolved theme resource in an in-memory cache. The cache is intended to accelerate repeat lookups for common locales such as en, de, or fr. The cache has no eviction policy and no upper bound on the number of distinct entries it retains for the process lifetime.

An attacker who submits many unique locale tags forces the server to allocate a new cache entry for each request. Sustained submission exhausts available Java Virtual Machine (JVM) heap memory and terminates the Keycloak process, disrupting authentication for all relying applications.

Root Cause

The root cause is missing input validation combined with an unbounded cache. The endpoint accepts any string as a locale tag rather than restricting input to a known allow-list of BCP 47 language codes. Because entries are never evicted, the cache grows without limit and consumes JVM heap until an OutOfMemoryError occurs.

Attack Vector

The attack is delivered over the network with no authentication and no user interaction. An attacker issues repeated HTTP requests to the theme localization endpoints, varying the locale query parameter with random or sequentially generated strings. Each unique value increases cache residency until the server becomes unresponsive or crashes.

No public proof-of-concept code is referenced in the advisory. Refer to the Red Hat CVE details for CVE-2026-79651 and Red Hat Bug Report #2523345 for authoritative technical context.

Detection Methods for CVE-2026-79651

Indicators of Compromise

High-volume HTTP requests to Keycloak theme or login endpoints containing unusual, random, or non-standard locale query parameter values.
Repeated OutOfMemoryError entries in Keycloak server logs or unexpected JVM process restarts.
Rapid growth in Keycloak JVM heap usage without a corresponding rise in legitimate authentication traffic.

Detection Strategies

Baseline the set of valid locale tags used by your applications and alert when requests deviate from the expected allow-list.
Correlate spikes in requests to /realms/{realm}/login-actions/ and theme resource paths with heap utilization metrics.
Deploy Web Application Firewall (WAF) rules that flag high-cardinality query parameter values from a single source.

Monitoring Recommendations

Enable JVM memory and garbage-collection telemetry for all Keycloak instances and forward metrics to your observability platform.
Monitor rate and diversity of the locale parameter per source IP and per realm.
Alert on Keycloak service restarts, container OOM kills, and Kubernetes pod evictions for identity workloads.

How to Mitigate CVE-2026-79651

Immediate Actions Required

Apply the fixed Keycloak packages referenced in Red Hat advisories RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278, and RHSA-2026:68280.
Place Keycloak behind a reverse proxy or WAF and rate-limit unauthenticated requests to theme and login endpoints.
Restrict the accepted locale parameter values to a known allow-list at the proxy layer until patches are deployed.

Patch Information

Red Hat has released patched builds through the following advisories: RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278, and RHSA-2026:68280. Consult the Red Hat CVE page for CVE-2026-79651 to confirm the fixed version applicable to your distribution.

Workarounds

Configure the upstream reverse proxy (for example NGINX or HAProxy) to reject requests whose locale parameter does not match a strict regular expression for BCP 47 tags.
Apply per-source-IP rate limits on Keycloak theme and login endpoints to blunt cache-flooding attempts.
Increase JVM heap only as a temporary buffer and pair with automated pod restart policies so a crash does not lead to prolonged outage.

bash

# Example NGINX allow-list for locale parameter values
map $arg_kc_locale $locale_allowed {
    default              0;
    "~^(en|de|fr|es|it|pt|ja|zh|ko)(-[A-Z]{2})?$" 1;
}

server {
    location /realms/ {
        if ($locale_allowed = 0) { return 400; }
        limit_req zone=keycloak_login burst=20 nodelay;
        proxy_pass http://keycloak_upstream;
    }
}