Cyber Posture

CVE-2026-4634

High

Published: 02 April 2026

Published
02 April 2026
Modified
16 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0008 23.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4634 is a high-severity Excessive Platform Resource Consumption within a Loop (CWE-1050) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 23.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application Exhaustion Flood (T1499.003). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-2 requires timely flaw remediation, directly addressing CVE-2026-4634 through installation of vendor patches like RHSA-2026:6475 to eliminate the resource exhaustion vulnerability.

prevent

SC-5 provides denial-of-service protection mechanisms that limit the effects of resource exhaustion from specially crafted long scope parameters in OIDC token requests.

prevent

SI-10 enforces information input validation to reject excessively long scope parameters, preventing high resource consumption and processing delays on the Keycloak server.

MITRE ATT&CK Enterprise TechniquesAI

T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Why these techniques?

The vulnerability directly enables an application exhaustion attack by allowing an unauthenticated remote attacker to submit a specially crafted request with an excessively long scope parameter to the OIDC token endpoint, causing high resource consumption and DoS on the Keycloak server.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and…

more

prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

Deeper analysisAI

CVE-2026-4634 is a denial-of-service (DoS) vulnerability in Keycloak, published on 2026-04-02. The flaw allows an unauthenticated attacker to send a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This triggers high resource consumption and prolonged processing times on the Keycloak server. The issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-1050.

An unauthenticated attacker with network access to the Keycloak server can exploit this vulnerability remotely with low complexity and no privileges required. By submitting the malicious request, the attacker causes significant resource exhaustion, leading to degraded performance or complete DoS, disrupting authentication and authorization services for legitimate users.

Red Hat has addressed this vulnerability in multiple security errata, including RHSA-2026:6475, RHSA-2026:6476, RHSA-2026:6477, and RHSA-2026:6478. Additional details on the CVE, including mitigation and patch information, are available at https://access.redhat.com/security/cve/CVE-2026-4634.

Details

CWE(s)

Affected Products

redhat
build of keycloak
26.2, 26.2.15, 26.4, 26.4.11, all versions

CVEs Like This One

CVE-2026-4636Same product: Redhat Build Of Keycloak
CVE-2026-3872Same product: Redhat Build Of Keycloak
CVE-2026-4282Same product: Redhat Build Of Keycloak
CVE-2026-3047Same product: Redhat Build Of Keycloak
CVE-2026-3121Same product: Redhat Build Of Keycloak
CVE-2026-3009Same product: Redhat Build Of Keycloak
CVE-2026-32589Same vendor: Redhat
CVE-2026-28368Same vendor: Redhat
CVE-2026-28369Same vendor: Redhat
CVE-2026-1616Same vendor: Redhat

References