CVE-2026-4634
Published: 02 April 2026
Summary
CVE-2026-4634 is a high-severity Excessive Platform Resource Consumption within a Loop (CWE-1050) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 7.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4634 is a denial-of-service (DoS) vulnerability in Keycloak, published on 2026-04-02. The flaw allows an unauthenticated attacker to send a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This triggers high resource consumption and prolonged processing times on the Keycloak server. The issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-1050.
An unauthenticated attacker with network access to the Keycloak server can exploit this vulnerability remotely with low complexity and no privileges required. By submitting the malicious request, the attacker causes significant resource exhaustion, leading to degraded performance or complete DoS, disrupting authentication and authorization services for legitimate users.
Red Hat has addressed this vulnerability in multiple security errata, including RHSA-2026:6475, RHSA-2026:6476, RHSA-2026:6477, and RHSA-2026:6478. Additional details on the CVE, including mitigation and patch information, are available at https://access.redhat.com/security/cve/CVE-2026-4634.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18212
Vulnerability details
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and…
more
prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly enables an application exhaustion attack by allowing an unauthenticated remote attacker to submit a specially crafted request with an excessively long scope parameter to the OIDC token endpoint, causing high resource consumption and DoS on the Keycloak server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing CVE-2026-4634 through installation of vendor patches like RHSA-2026:6475 to eliminate the resource exhaustion vulnerability.
SC-5 provides denial-of-service protection mechanisms that limit the effects of resource exhaustion from specially crafted long scope parameters in OIDC token requests.
SI-10 enforces information input validation to reject excessively long scope parameters, preventing high resource consumption and processing delays on the Keycloak server.