Vulnerability · Published Nov 5, 2026 · Assigned by redhat

CVE-2026-110932Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Single Sign-On 7	see references

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://access.redhat.com/security/cve/CVE-2026-110932 vdb-entry, x_refsource_REDHAT
RHBZ#2553049 issue-tracking, x_refsource_REDHAT