CVE-2026-9801: Keycloak LDAP OutOfMemoryError Denial of Service

Technical summary

The vulnerability stems from improper handling of malformed LDAP password policy responses in Keycloak's authentication flow. When a user attempts to authenticate and Keycloak queries an LDAP server for password policy information, a crafted response can trigger an uncontrolled memory allocation, resulting in an OutOfMemoryError in the JVM. This leads to immediate process termination. The issue is rooted in insufficient input validation and resource bounds enforcement when parsing LDAP policy data, classified under CWE-1284 (Improper Validation of Specified Quantity in Input).

Business impact

This vulnerability directly impacts service availability. A successful exploit renders the Keycloak instance unavailable to all users and applications relying on that node for authentication and authorization. In multi-node deployments, the attack targets individual nodes; however, if the malicious LDAP configuration or compromise affects the entire directory backend, repeated crashes could disrupt the authentication infrastructure. For organizations with single-node Keycloak deployments or those where all nodes query the same LDAP source, this becomes a critical availability risk despite the MEDIUM CVSS score.

Affected systems

Red Hat build of Keycloak is confirmed affected. Organizations running Keycloak instances that authenticate users via LDAP—whether configured directly by administrators or inherited from upstream directory services—are in scope. The attack surface is limited to realms explicitly configured with LDAP authentication, but all realms on the affected node experience the denial of service once the vulnerability is triggered.

Exploitability

Exploitation requires high privilege: either administrative access to Keycloak to configure a malicious LDAP server connection, or prior compromise of an upstream LDAP directory. The attack itself is trivial once those conditions are met—sending a malformed LDAP response during an authentication attempt triggers the fault. No user interaction or additional complexity is required. However, the privilege barrier significantly limits the number of realistic attack scenarios. This is not a remote code execution path; it is strictly a denial of service mechanism.

Remediation

Patch Keycloak to the fixed version specified in the official Red Hat advisory. After patching, verify that all LDAP server connections are properly validated and originate from trusted, secure infrastructure. Review LDAP server configurations and network segmentation to ensure upstream directory services cannot be trivially compromised. For interim mitigation on non-critical environments, consider temporarily disabling LDAP authentication until a patch is deployed, though this may not be practical in production.

Patch guidance

Obtain and deploy the patched version of Red Hat build of Keycloak from Red Hat's security advisory. Verify the patch version against the advisory to ensure you are deploying the correct release. Test the patch in a staging environment with live LDAP authentication scenarios before production rollout. Document the patching timeline and ensure all Keycloak nodes in your deployment are updated, as nodes running older versions remain vulnerable.

Detection guidance

Monitor Keycloak JVM logs for OutOfMemoryError events coupled with LDAP authentication activity. Sudden, unexplained Keycloak process restarts correlated with failed authentication attempts may indicate exploitation attempts. Examine LDAP server logs for anomalous or malformed policy requests. Alert on repeated authentication failures followed by service crashes. In a SOC context, correlate Keycloak availability drops with LDAP traffic analysis to detect suspicious patterns. Baseline normal JVM memory usage and flag deviations during authentication peaks.

Why prioritize this

Although assigned MEDIUM severity, this vulnerability deserves elevated attention in organizations heavily dependent on Keycloak for centralized authentication. The availability impact is severe, and the privilege barrier, while real, may be lower in environments where LDAP administrators are less carefully segregated from potential compromise vectors or where supply-chain risks to LDAP infrastructure exist. Prioritization should reflect your authentication architecture criticality and LDAP trust posture, not CVSS alone.

Risk score, explained

The CVSS 3.1 score of 4.9 (MEDIUM) reflects the high-privilege requirement (PR:H) and lack of confidentiality or integrity impact (C:N, I:N). However, the availability impact is rated high (A:H) due to complete service loss on affected nodes. The score appropriately discounts for the admin-level access prerequisite but does not fully capture the business criticality of authentication infrastructure outages in most enterprise contexts. Organizations should apply business context to this technical score.

Frequently asked questions