CVE-2026-16100: redhat build of keycloak

csirt@kutim:~/threat-intel/cve/CVE-2026-16100

CVSS 6.5 · Medium EPSS 0,55%

Kerentanan Allocation of Resources Without Limits or Throttling pada redhat build of keycloak. Skor CVSS 3.1 6.5 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

Rincian

Terbit di NVD: 5 Agustus 2026
Terakhir diubah: 31 Agustus 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari): 0,55% peluang dieksploitasi; lebih tinggi dari 44,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
redhat	build of keycloak	Versi 26.6 hingga sebelum 26.6.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://access.redhat.com/errata/RHSA-2026:50848 advisory vendor
https://access.redhat.com/errata/RHSA-2026:50849 advisory vendor
https://access.redhat.com/security/cve/CVE-2026-16100 advisory vendor
https://bugzilla.redhat.com/show_bug.cgi?id=2501730 issue tracking · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.