Denial of Service Vulnerability in Keycloak Theme Localization

CVE-2026-79651 is a high-severity denial-of-service vulnerability located within the theme localization endpoints of the keycloak-services component. This component is responsible for managing authentication flows and UI themes. The vulnerability stems from improper validation and resource management, where the server accepts arbitrary, user-supplied locale tags from unauthenticated HTTP requests. These tags are subsequently stored in an in-memory cache without any capacity limits or TTL enforcement. By repeatedly submitting unique and randomized locale tags, an attacker can force the Keycloak application to populate the cache until the JVM heap is fully consumed, triggering an OutOfMemoryError and crashing the service. This attack requires no authentication and can be performed remotely against any exposed Keycloak instance, posing a significant availability risk to identity and access management infrastructures.

Impact

Successful exploitation results in a complete denial-of-service condition for the Keycloak instance. Because Keycloak serves as a central authentication provider, an outage directly impacts all downstream applications and services relying on it for OIDC or SAML authentication, potentially locking users out of corporate systems.

Recommendation

1. Patch Keycloak instances by updating to the version containing the fix for CVE-2026-79651 immediately upon vendor release.
2. Implement request rate limiting and monitoring on the /realms/{realm}/protocol/openid-connect/auth and theme-related endpoints to detect anomalous volumes of requests containing unique locale parameters.
3. Review web server or reverse proxy logs (e.g., Nginx, Apache) for high-frequency requests targeting theme localization parameters that result in 500-series server error codes.