Описание
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
Отчет
The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires an authenticated user with specific account management permissions. Successful exploitation allows an attacker to cause a denial of service by exhausting system memory through the creation of an unbounded number of metric time series. The vulnerability's root cause is the use of request-controlled, unsanitized input within Prometheus metric labels.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Data Grid 8 | keycloak-services | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | keycloak-services | Not affected | ||
| Red Hat Single Sign-On 7 | keycloak-services | Not affected | ||
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-operator-bundle | Fixed | RHSA-2026:50849 | 05.08.2026 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9 | Fixed | RHSA-2026:50849 | 05.08.2026 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2026:50849 | 05.08.2026 |
| Red Hat build of Keycloak 26.6.5 | keycloak-services | Fixed | RHSA-2026:50848 | 05.08.2026 |
| Red Hat build of Keycloak 26.6.5 | rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 | Fixed | RHSA-2026:50848 | 05.08.2026 |
| Red Hat build of Keycloak 26.6.5 | rhbk-openshift-rhel9/rhbk-openshift-rhel9 | Fixed | RHSA-2026:50848 | 05.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
A flaw was found in the user-event metrics recording of Keycloak. When ...
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
EPSS
6.5 Medium
CVSS3