7.5High
CVE-2026-4634Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
Description
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
Weakness (CWE):
CWE-1050
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| build keycloak | 26.2 | — | |
| build keycloak | 26.4 | — | |
| redhat | build of keycloak | 26.2 | |
| Red Hat | Red Hat build of Keycloak 26.2 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.2.15 | — | |
| Red Hat | Red Hat build of Keycloak 26.4 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.4.11 | — | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6.13 | — | |
| Red Hat | RHEL-8 based Middleware Containers | all versions | |
| red hat single sign on | 7.6 | — | |
| rhosemc | 1.0 | — |
References and patches
- RHSA-2026:6475 vendor-advisoryVendor Advisory
- RHSA-2026:6476 vendor-advisoryVendor Advisory
- RHSA-2026:6477 vendor-advisoryVendor Advisory
- RHSA-2026:6478 vendor-advisoryVendor Advisory
- RHSA-2026:76128 vendor-advisory
- RHSA-2026:76129 vendor-advisory
- RHSA-2026:76130 vendor-advisory
- RHSA-2026:76132 vendor-advisory
- RHSA-2026:76134 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-4634 vdb-entryVendor Advisory
- RHBZ#2450250 issue-trackingIssue TrackingVendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4634.json
CPE matches (NVD) (5)
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:build_of_keycloak:26.2:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:build_of_keycloak:26.2.15:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:build_of_keycloak:26.4:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:build_of_keycloak:26.4.11:*:*:*:text-only:*:*:*