Executive brief
Keycloak, a popular identity and access management solution, is vulnerable to a denial-of-service attack when integrated with LDAP directory services. An attacker with administrative privileges or control over a connected LDAP server can send a specially crafted response that causes the Keycloak server to run out of memory and crash. This results in a complete service outage for all users and applications relying on the affected Keycloak instance for authentication.
Technical details
A vulnerability exists in the Keycloak LDAP federation provider (org.keycloak:keycloak-ldap-federation) due to improper validation of specified quantities in input (CWE-1284). A remote attacker with high privileges (such as a realm administrator) or an attacker who has compromised an upstream LDAP server can exploit this by sending a malformed LDAP password policy response during an authentication request. This malformed input triggers an OutOfMemoryError within the Java Virtual Machine (JVM), causing the process to terminate and resulting in a denial of service for all realms on the node. The issue is fixed in Keycloak version 26.6.3.
Affected products
- Keycloak Keycloak < 26.6.3
- Keycloak keycloak-ldap-federation < 26.6.3
- Red Hat Red Hat build of Keycloak 26.4, 26.6
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-06-10: patched: Red Hat security advisory issued