CyberRota Analysis
AI-GeneratedA vulnerability exists in the theme localization endpoints of the keycloak-services component, allowing unauthenticated attackers to submit arbitrary locale tags that are stored in an unbounded in-memory cache. This can lead to a denial-of-service condition by exhausting server memory, resulting in crashes. Organizations using Keycloak for authentication should prioritize addressing this issue to maintain service availability and security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.