Keycloak theme resource endpoint lets unauthenticated users exhaust disk space

Anyone can send fake requests to a login server and fill its disk, stopping it.

Summary

Keycloak's theme resource endpoint uses unvalidated theme names as keys for an on-disk gzip cache. An unauthenticated attacker sending many requests with fabricated theme names can fill the disk and disrupt service, and the damage persists across restarts.

What to do

Update to Red Hat build of Keycloak 26.6.8 or later. See advisory RHSA-2026:95761.

Products and platforms

Linux
Red Hat build of Keycloak 26.6
Red Hat build of Keycloak 26.6.8
Red Hat Single Sign-On 7

CVE IDs

CVE-2026-110932 (opens in a new tab)

Sources

Advisory: access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab)

Times

First published 2026-11-05 16:04 UTC

First seen 2026-11-09 17:00 UTC