PT-2026-44194 · Red Hat · Keycloak

Osidb Bzimport · Published 2026-05-28 · Updated 2026-06-26 · CVE-2026-9801

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw allows a remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker who has compromised an upstream LDAP server, to cause a denial of service. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This results in the termination of the Java Virtual Machine (JVM), which is the engine that allows Java applications to run, leading to a denial of service for all realms on the affected node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2026-9801

GHSA-F6R7-6W34-X2GP

Affected Products

Keycloak

References · 17

• https://access.redhat.com/errata/RHSA-2026:25097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9801 · Security Note
• https://access.redhat.com/errata/RHSA-2026:30050 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2482473 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f6r7-6w34-x2gp · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25098 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-9801 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30049 · Vendor Advisory
• https://github.com/keycloak/keycloak/issues/49434 · Note
• https://github.com/keycloak/keycloak/pull/49514 · Note
• https://github.com/keycloak/keycloak/commit/2c4fe42235ba8c265b1da3a30541a270d5bd8c39 · Note
• https://github.com/keycloak/keycloak · Note
• https://t.me/cveNotify/176662 · Telegram Post
• https://twitter.com/dailycve/status/2062319812219441161 · Twitter Post
• https://t.me/cveNotify/166963 · Telegram Post