CVE-2026-9801: Keycloak LDAP DoS Vulnerability

CVE-2026-9801 Overview

A denial of service vulnerability affects Keycloak, the open-source identity and access management solution. The flaw resides in how Keycloak processes Lightweight Directory Access Protocol (LDAP) password policy responses during authentication. A remote attacker with high privileges, such as a realm administrator able to configure a malicious LDAP server, or an attacker who has compromised an upstream LDAP server, can send a malformed LDAP password policy response. This triggers an OutOfMemoryError that terminates the Keycloak Java Virtual Machine (JVM). The result is a denial of service affecting all realms on the impacted node. This issue maps to [CWE-1284] (Improper Validation of Specified Quantity in Input).

Critical Impact

A single malformed LDAP response can terminate the Keycloak JVM, taking down authentication for every realm hosted on the affected node.

Affected Products

• Red Hat Keycloak
• Red Hat build of Keycloak (RHBK)
• Upstream Keycloak deployments configured with LDAP user federation

Discovery Timeline

• 2026-05-28 - CVE CVE-2026-9801 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-9801

Vulnerability Analysis

The vulnerability occurs in the Keycloak LDAP authentication code path. When Keycloak issues a password authentication request to an upstream LDAP server, it parses the password policy response control returned by that server. The parsing logic does not enforce sane bounds on values declared within the response. A malformed response causes Keycloak to attempt an excessive memory allocation, exhausting the heap and triggering a JVM OutOfMemoryError. Once the JVM terminates, every realm served by that Keycloak node loses authentication capability until the process is restarted. Because the failure is at the JVM level rather than scoped to a single request thread, the blast radius extends across tenants on multi-realm deployments.

Root Cause

The root cause is improper validation of a quantity field in attacker-controlled input. The LDAP password policy response contains length or count values that Keycloak uses to size internal buffers without verifying those values are reasonable. Supplying an oversized value forces a large allocation that the JVM cannot satisfy.

Attack Vector

Exploitation requires network reach to Keycloak and high privileges. Two scenarios are documented in the Red Hat advisory. First, a realm administrator can point user federation at an LDAP server they control and return crafted password policy responses. Second, an attacker who has already compromised an upstream LDAP server can return the malicious response during normal authentication. The attack consumes no user interaction and produces an availability impact on the Keycloak service. See the Red Hat CVE-2026-9801 Advisory and Red Hat Bug Report #2482473 for vendor analysis.

Detection Methods for CVE-2026-9801

Indicators of Compromise

• OutOfMemoryError entries in Keycloak server logs correlated with active LDAP bind or password authentication operations.
• Unexpected Keycloak JVM termination or container restart events affecting all realms simultaneously.
• LDAP federation configuration changes pointing to unfamiliar or external LDAP server hostnames or IP addresses.

Detection Strategies

• Monitor Keycloak event logs for repeated failed LDAP authentication attempts followed by service crashes.
• Audit administrative actions that create or modify LDAP user federation providers, particularly changes to the connection URL.
• Inspect network traffic from Keycloak nodes to LDAP servers for responses containing abnormally large password policy control fields.

Monitoring Recommendations

• Alert on JVM heap exhaustion metrics and process restart counters for Keycloak instances.
• Track Keycloak admin API calls that modify LDAPStorageProvider configurations.
• Forward Keycloak and host logs to a centralized analytics platform to correlate LDAP errors with availability incidents.

How to Mitigate CVE-2026-9801

Immediate Actions Required

• Apply the Keycloak security update referenced in the Red Hat CVE-2026-9801 Advisory as soon as patched packages are available for your distribution.
• Restrict realm administrator privileges to a minimal set of trusted operators, since the vulnerability requires high privileges to configure LDAP federation.
• Review existing LDAP user federation providers and confirm each points to an LDAP server under organizational control.

Patch Information

Red Hat tracks the fix under Red Hat Bug Report #2482473. Consult the vendor advisory for the specific Keycloak and Red Hat build of Keycloak versions that contain the corrected LDAP password policy response parsing.

Workarounds

• Limit egress from Keycloak nodes to known LDAP server addresses using network policies or firewall rules.
• Enforce LDAPS with strict certificate validation to reduce the risk of upstream LDAP server impersonation.
• Deploy Keycloak in a high-availability cluster so that a JVM crash on one node does not eliminate authentication service entirely.

# Example: restrict Keycloak egress to a known LDAP server using iptables
iptables -A OUTPUT -p tcp -d <trusted-ldap-server-ip> --dport 636 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 389 -j REJECT
iptables -A OUTPUT -p tcp --dport 636 -j REJECT