CVE-2026-9801

Katalog CVE

CVSS 4.9 · Medium EPSS 0,90%

Kerentanan Improper Validation of Specified Quantity in Input pada redhat build of keycloak. Skor CVSS 3.1 4.9 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.

Rincian

Terbit di NVD

28 Mei 2026

Terakhir diubah

26 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1284: Improper Validation of Specified Quantity in Input

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-9801 mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2482473 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:25097
• https://access.redhat.com/errata/RHSA-2026:25098
• https://access.redhat.com/errata/RHSA-2026:30049
• https://access.redhat.com/errata/RHSA-2026:30050