CVE-2026-16100

Analyzed Analyzed - Analysis Complete

Keycloak Metrics Memory Exhaustion via User Input

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-16

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-15

NVD

CVE-2026-16100

EUVD

EUVD-2026-53384

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	build_of_keycloak	From 26.6 (inc) to 26.6.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability involves Keycloak's metrics system recording raw error messages from failed account operations as Prometheus metric labels. Authenticated users can exploit this by submitting many unique inputs like nonexistent client IDs, creating excessive metric entries that exhaust system memory, leading to service crashes or unavailability.

Detection Guidance

Monitor Prometheus metrics for unusually high label cardinality or memory exhaustion in Keycloak. Check Keycloak logs for excessive error messages related to user operations.

Impact Analysis

If you use Keycloak with metrics enabled, an attacker could crash your authentication service by flooding it with unique error messages. This would disrupt user access, cause downtime, and potentially lead to denial-of-service conditions affecting your applications.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that violate availability requirements in GDPR or HIPAA. Downtime may lead to unauthorized access risks or failure to meet uptime obligations, potentially resulting in regulatory penalties or data protection violations.

Mitigation Strategies

Disable metrics recording if not required. If metrics are needed, restrict label values to prevent user-supplied input. Update Keycloak to the latest patched version as soon as available.

Hi! I’m here to help you understand CVE-2026-16100. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70