Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

Keycloak can overload memory with endless metrics

CVE-2026-101333 · published 1 month ago
Summary

The Red Hat version of Keycloak and Red Hat Single Sign‑On 7 can be tricked into generating unlimited monitoring data when anyone sends specially crafted login requests. This consumes memory and can slow down the server and its monitoring tools. Apply the vendor’s update or disable the optional metric tag to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– red hat red hat build of keycloak All versions
– red hat red hat single sign-on 7 All versions
Ubuntu:24.04:LTS canonical python-keycloak All versions
Original advisory text
Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint
A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series. This can lead to excessive memory consumption and degrade the performance of both the server and its monitoring tools.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published28 Sep 2026
Updated4 Nov 2026
First seen28 Sep 2026
Sources
CVE-2026-101333 · NVD
CVE-2026-101333 · MITRE
UBUNTU-CVE-2026-101333 · OSV
Track software like this
Free during beta