Keycloak: Disk space exhaustion denial-of-service in theme resource endpoint (CVE-2026-110932)

A vulnerability in the theme resource endpoint of Keycloak allows unauthenticated attackers to cause a denial-of-service via disk space exhaustion. The vulnerability exists because the server fails to properly validate theme names before using them as keys for an on-disk gzip cache. By submitting a high volume of requests with unique, fabricated theme names, an attacker can force the application to cache these as distinct files on the server's disk. This cache persists across service restarts, potentially leading to system-wide disk space depletion and service disruption.

Impact

Successful exploitation results in service unavailability due to disk space exhaustion. The cached files persist across server reboots, requiring manual cleanup of the storage directory to restore service functionality.

Recommendation

• Inventory all instances of Keycloak to identify exposed theme resource endpoints.
• Monitor disk usage on servers hosting Keycloak for rapid, anomalous growth in cache or temporary storage directories.
• Apply security patches provided by the Keycloak project as soon as they become available to address input validation failures at the theme resource endpoint.
• Restrict access to the theme resource endpoint via network-level controls or a web application firewall (WAF) if immediate patching is not possible.