A vulnerability in Keycloak's theme resource endpoint allows unauthenticated attackers to exhaust server disk space by sending numerous requests with unique, fabricated theme names. This leads to persistent disk space exhaustion that survives server restarts and causes denial of service. The root cause is the lack of validation of theme names used as keys for an on-disk gzip cache.