← CVE Intelligence

CVE-2026-4634

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters PUBLISHED

Description (CNA)

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2.15-1 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-18 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-18 before *
Red Hat / Red Hat build of Keycloak 26.2.15unaffected
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4.11-1 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-14 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-14 before *
Red Hat / Red Hat build of Keycloak 26.4.11unaffected
Red Hat / Red Hat Single Sign-On 7.6.13unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.20-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.20-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.20-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6-85 before *

CWE

CWE-1050

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.