Is CVE-2026-110932 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110932 being exploited in the wild.

How severe is CVE-2026-110932?

High severity, with a CVSS score of 7.5, published 5 November 2026.

Is there a fix for CVE-2026-110932?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-110932 attacked?

It is attacked over the network.

Am I affected by CVE-2026-110932?

Check whether you run Red Hat build of Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110932: Keycloak theme resource disk exhaustion

CVE-2026-110932 · Severity: high · CVSS 7.5 · Published 2026-11-05

Keycloak is an identity and access management system that handles user authentication and authorization for applications. An attacker can send specially crafted requests with fake theme names to exhaust the server's disk space, preventing legitimate users from logging in and using the system. This denial-of-service attack requires no authentication and persists even after the server restarts.

Technologies: Red Hat build of Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-110932 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110932 being exploited in the wild.
How severe is CVE-2026-110932?: High severity, with a CVSS score of 7.5, published 5 November 2026.
Which products and versions are affected?: Red Hat build of Keycloak.
Is there a fix for CVE-2026-110932?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-110932 attacked?: It is attacked over the network.
Am I affected by CVE-2026-110932?: Check whether you run Red Hat build of Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The theme resource endpoint in Keycloak fails to validate theme names before using them as cache keys for on-disk gzip storage, allowing uncontrolled resource consumption. An unauthenticated remote attacker can exploit this via network requests with fabricated theme names to trigger persistent disk space exhaustion (CWE-400), causing service disruption that survives restarts.

Affected products

Red Hat build of Keycloak

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.