This vulnerability arises from unbounded allocation of resources due to the recording of unsanitized, user-controlled error messages as Prometheus metric labels in Keycloak's user-event metrics. When metrics are enabled, an authenticated user with account management permissions can generate a large number of unique metric entries by supplying varied input (e.g., nonexistent client IDs), leading to memory exhaustion and service unavailability. The flaw is tracked as CWE-770 and has a CVSS v3.1 base score of 6.5 with an availability impact rated high. The affected versions are >=26.6.0 and <26.6.5 of Red Hat build of Keycloak. Red Hat has assessed the severity as moderate and currently does not provide a patch or effective mitigation that meets their standards.

Successful exploitation allows an authenticated user with specific account management permissions to cause a denial of service by exhausting system memory through creation of an unbounded number of Prometheus metric time series. This leads to service crashes or unavailability. There is no impact on confidentiality or integrity.

Red Hat currently does not provide a patch or mitigation that meets their criteria for ease of use, deployment, or applicability. Users should monitor Red Hat advisories for updates. Since no official fix is available, consider restricting access to account management features to trusted users only and disabling metrics if feasible until a fix is released.