CVE-2026-9803: Out-of-bounds Read in Red Hat Red Hat build of Keycloak 26.4
A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service.
AI Analysis
Technical Summary
The vulnerability CVE-2026-9803 affects the ClientRegistrationAuth component of Red Hat build of Keycloak 26.4. It allows a remote unauthenticated attacker to trigger an out-of-bounds read by sending a malformed 'Authorization: Bearer' header in a POST request to client registration endpoints. This causes an ArrayIndexOutOfBoundsException, leading to an HTTP 500 server error and denial of service. Red Hat's advisory for Keycloak 26.6.3 includes this fix among other security updates. The advisory does not explicitly state a patch for version 26.4 but provides updated container images for 26.6.3. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with no confidentiality or integrity impact, only availability impact. No known exploits have been reported.
Potential Impact
Successful exploitation causes a denial of service by crashing the Keycloak server with an HTTP 500 error due to an ArrayIndexOutOfBoundsException. There is no direct confidentiality or integrity impact reported. The service disruption could affect authentication availability for applications relying on Keycloak.
Mitigation Recommendations
Red Hat has released updated Keycloak 26.6.3 container images that address this vulnerability along with others. Users should upgrade to Red Hat build of Keycloak 26.6.3 as provided in the official advisory. Before updating, back up existing installations including configurations and databases. No direct patch for version 26.4 is explicitly mentioned, so upgrading to the fixed version is the recommended remediation. Monitor Red Hat advisories for any further updates.
CVE-2026-9803: Out-of-bounds Read in Red Hat Red Hat build of Keycloak 26.4
Description
A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service.
CVSS v3.1
Score 5.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-9803 affects the ClientRegistrationAuth component of Red Hat build of Keycloak 26.4. It allows a remote unauthenticated attacker to trigger an out-of-bounds read by sending a malformed 'Authorization: Bearer' header in a POST request to client registration endpoints. This causes an ArrayIndexOutOfBoundsException, leading to an HTTP 500 server error and denial of service. Red Hat's advisory for Keycloak 26.6.3 includes this fix among other security updates. The advisory does not explicitly state a patch for version 26.4 but provides updated container images for 26.6.3. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with no confidentiality or integrity impact, only availability impact. No known exploits have been reported.
Potential Impact
Successful exploitation causes a denial of service by crashing the Keycloak server with an HTTP 500 error due to an ArrayIndexOutOfBoundsException. There is no direct confidentiality or integrity impact reported. The service disruption could affect authentication availability for applications relying on Keycloak.
Mitigation Recommendations
Red Hat has released updated Keycloak 26.6.3 container images that address this vulnerability along with others. Users should upgrade to Red Hat build of Keycloak 26.6.3 as provided in the official advisory. Before updating, back up existing installations including configurations and databases. No direct patch for version 26.4 is explicitly mentioned, so upgrading to the fixed version is the recommended remediation. Monitor Red Hat advisories for any further updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-05-28T04:02:28.881Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-9803","vendor":"Red Hat"}]
Threat ID: 6a17daeae29bf47b50b180fe
Added to database: 05/28/2026, 06:04:26 UTC
Last enriched: 06/26/2026, 12:23:09 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.