CVE-2026-79651

CVE-2026-79651 is an uncontrolled resource-consumption flaw (CWE-400) in the theme localization endpoints of the keycloak-services component of Keycloak, the open-source identity and access management software that handles authentication flows and theme management. The endpoints accept arbitrary locale tags from unauthenticated requests and store them in a permanent in-memory cache that has no size or entry limits. A remote attacker with no credentials can send a large volume of unique locale tags, filling this cache until the server exhausts memory and crashes, causing a denial of service; there is no confidentiality or integrity impact. Any deployment of Keycloak exposing the affected endpoints, especially over the internet, is affected. No public proof-of-concept is known and the flaw is not listed in the CISA KEV catalog at the time of writing, though the attack requires no special conditions (low attack complexity, no privileges, no user interaction).

What to do: Apply the fixed Keycloak release as soon as Red Hat publishes it, since this advisory does not specify a patched version. As an interim mitigation, restrict or rate-limit unauthenticated access to the theme localization endpoints at a reverse proxy, WAF, or load balancer, and ensure memory monitoring and automatic restart policies are in place. Check whether your Keycloak instances (including the Red Hat build of Keycloak, if deployed) expose these endpoints publicly, as internet-facing authentication servers are the most likely targets.