PT-2026-44196 · Red Hat · Keycloak

Mustafa Çetin · CVE-2026-9803 · Published 2026-05-28 · Updated 2026-06-26

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the ClientRegistrationAuth component allows a remote unauthenticated attacker to cause a Denial of Service (DoS). By sending a specially crafted POST request with a malformed Authorization: Bearer header to any client registration endpoint, an ArrayIndexOutOfBoundsException is triggered. This results in the server returning an HTTP 500 error, making the affected service unavailable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-9803

GHSA-CPF7-J4CF-VQX4

Affected Products

Keycloak

References · 20

• https://osv.dev/vulnerability/GHSA-cpf7-j4cf-vqx4 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2482465 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30050 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9803 · Security Note
• https://access.redhat.com/errata/RHSA-2026:25097 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25098 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30049 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-9803 · Vendor Advisory
• https://github.com/keycloak/keycloak/pull/49618 · Note
• https://github.com/keycloak/keycloak/pull/49617 · Note
• https://github.com/keycloak/keycloak/commit/3fc06909cc93eb5c4739a712fa350de625812e04 · Note
• https://github.com/keycloak/keycloak/issues/49433 · Note
• https://github.com/keycloak/keycloak/commit/ef06df91d344c7e99fcb82987ef6adb854f30789 · Note
• https://github.com/keycloak/keycloak/commit/2b8692499e907e6205be0bd9c8a4da5d46f6ca30 · Note
• https://github.com/keycloak/keycloak/pull/49500 · Note