CVE-2026-79651: Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-16
Weakness: CWE-400

Description

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.

Affected products

Red Hat build of Keycloak 26.4: all versions — fixed in 26.4-26, 26.4.16-2, 26.6-20, 26.6.7-3

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4-26, 26.4.16-2, 26.6-20, 26.6.7-3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-79651 or the next vulnerability affects your stack