CVE-2026-101333
Received Received - Intake

Keycloak Micrometer Listener Memory Exhaustion via IdP Tag

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: redhat-SADP

Description
A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series. This can lead to excessive memory consumption and degrade the performance of both the server and its monitoring tools.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101333
EUVD
EUVD-2026-88313

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat keycloak From 3.7 (inc)
redhat keycloak From 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Keycloak's Micrometer user-event metrics listener when configured with the idp tag. An unauthenticated attacker can exploit it by sending requests to the identity broker login endpoint using arbitrary provider aliases. This causes the system to create an unlimited number of metric time series, leading to excessive memory consumption and degraded server and monitoring tool performance.

Detection Guidance

To detect this vulnerability, monitor for excessive memory usage in Keycloak processes and check for an unusually high number of metric time series being generated. Inspect Keycloak logs for repeated requests to the identity broker login endpoint with arbitrary provider aliases. Use system monitoring tools like top, htop, or ps to track memory consumption by the Keycloak service.

Impact Analysis

The vulnerability can cause resource exhaustion on the server hosting Keycloak, leading to degraded performance or crashes. Monitoring tools may also become overwhelmed due to the unbounded creation of metric time series, affecting their ability to track system health and performance accurately.

Compliance Impact

This vulnerability primarily causes resource exhaustion through unbounded metric series creation, which could degrade server performance and monitoring tools. While not directly violating GDPR or HIPAA, such degradation may impact systems handling regulated data by reducing availability or integrity, potentially leading to non-compliance if critical security or operational functions are impaired.

Mitigation Strategies

Disable the Micrometer user-event metrics listener if it is configured with the idp tag. If disabling is not feasible, restrict access to the identity broker login endpoint to trusted sources only. Monitor system resources closely for signs of resource exhaustion. Apply any vendor-provided patches or updates as soon as they become available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101333. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart