The vulnerability exists because the keycloak-services component accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without any bounds or validation. An attacker can exploit this by sending a large number of unique locale tags, which exhausts the server's memory resources and causes it to crash. This issue affects the core service responsible for authentication flows and theme management in Keycloak. The Red Hat Product Security team has assessed the severity as Important (high), noting that exploitation leads to a complete denial of service. No patch or mitigation meeting Red Hat's criteria is currently available.

Successful exploitation results in a denial of service by crashing the Keycloak server due to memory exhaustion. This prevents legitimate users from accessing authentication services and may impact the stability of the surrounding environment. The vulnerability does not affect confidentiality or integrity but impacts availability.

Currently, no mitigation or patch is available that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is provided, consider limiting exposure of the affected endpoints or applying network-level protections to reduce attack surface.