CVE-2026-9801: Improper Validation of Specified Quantity in Input in Red Hat Red Hat build of Keycloak 26.4
A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.
AI Analysis
Technical Summary
The vulnerability CVE-2026-9801 affects Red Hat build of Keycloak 26.4 and allows a remote attacker with high privileges to cause a denial of service by sending a malformed LDAP password policy response during authentication. This malformed response triggers an OutOfMemoryError in the Keycloak JVM, causing it to terminate and resulting in service disruption for all realms on the affected node. The issue arises from improper validation of specified quantity in input. Red Hat has published security advisories (RHSA-2026:25097 and RHSA-2026:25098) releasing new Keycloak 26.6.3 images that address this and other vulnerabilities. The advisories recommend updating to these new images to mitigate the issue. However, the advisories do not explicitly state a patch or fix specifically for CVE-2026-9801 outside of the new image releases.
Potential Impact
Successful exploitation results in a denial of service (DoS) condition by causing the Keycloak JVM to terminate due to an OutOfMemoryError. This disrupts authentication services for all realms on the affected node. There is no impact on confidentiality or integrity reported. The attacker must have high privileges such as a realm administrator or control over an upstream LDAP server to exploit this vulnerability.
Mitigation Recommendations
Red Hat has released updated Red Hat build of Keycloak 26.6.3 images that include fixes for CVE-2026-9801. Users should update to these new images as provided in the Red Hat advisories RHSA-2026:25097 and RHSA-2026:25098. Before applying updates, back up existing installations including applications, configuration files, and databases. No other specific mitigations or temporary workarounds are mentioned in the vendor advisory.
CVE-2026-9801: Improper Validation of Specified Quantity in Input in Red Hat Red Hat build of Keycloak 26.4
Description
A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.
CVSS v3.1
Score 4.9medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-9801 affects Red Hat build of Keycloak 26.4 and allows a remote attacker with high privileges to cause a denial of service by sending a malformed LDAP password policy response during authentication. This malformed response triggers an OutOfMemoryError in the Keycloak JVM, causing it to terminate and resulting in service disruption for all realms on the affected node. The issue arises from improper validation of specified quantity in input. Red Hat has published security advisories (RHSA-2026:25097 and RHSA-2026:25098) releasing new Keycloak 26.6.3 images that address this and other vulnerabilities. The advisories recommend updating to these new images to mitigate the issue. However, the advisories do not explicitly state a patch or fix specifically for CVE-2026-9801 outside of the new image releases.
Potential Impact
Successful exploitation results in a denial of service (DoS) condition by causing the Keycloak JVM to terminate due to an OutOfMemoryError. This disrupts authentication services for all realms on the affected node. There is no impact on confidentiality or integrity reported. The attacker must have high privileges such as a realm administrator or control over an upstream LDAP server to exploit this vulnerability.
Mitigation Recommendations
Red Hat has released updated Red Hat build of Keycloak 26.6.3 images that include fixes for CVE-2026-9801. Users should update to these new images as provided in the Red Hat advisories RHSA-2026:25097 and RHSA-2026:25098. Before applying updates, back up existing installations including applications, configuration files, and databases. No other specific mitigations or temporary workarounds are mentioned in the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-05-28T04:00:46.722Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-9801","vendor":"Red Hat"}]
Threat ID: 6a17daeae29bf47b50b180f6
Added to database: 05/28/2026, 06:04:26 UTC
Last enriched: 06/26/2026, 12:22:51 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.