CVE-2026-79651: Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching
A flaw was found in Keycloak where the theme localization endpoints (/resources/master/common/{locale} and /admin/{realm}/console/messages.json) fail to validate or limit the locale tags provided in the request. Each unique locale tag results in a new entry being created in an unbounded in-memory cache within the theme message system. An unauthenticated remote attacker can exploit this by sending a high volume of HTTP GET requests containing unique BCP 47 locale tags. Because the cache is permanent and has no size limit, this leads to continuous heap memory consumption. Successful exploitation allows an attacker to exhaust the JVM heap memory, leading to an OutOfMemoryError and causing the Keycloak service to terminate, resulting in a complete denial of service.
Other sources
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to send HTTP GET requests to the affected Keycloak theme localization endpoints can exploit it. No privileges or user interaction are required.
What does exploitation require?
The attacker must send a high volume of requests using unique BCP 47 locale tags to /resources/master/common/{locale} or /admin/{realm}/console/messages.json. Each unique tag creates a permanent cache entry, consuming additional JVM heap memory.
Are default deployments exposed?
The vulnerable endpoints accept arbitrary locale tags from unauthenticated requests, so deployments that expose these endpoints to untrusted network clients are at risk. The provided information does not identify any configuration setting that disables the affected behavior.
What happens when an attack succeeds?
Heap consumption continues until the JVM exhausts available memory and raises an OutOfMemoryError. This can terminate the Keycloak service and cause complete denial of service.
How can I tell whether exploitation may be occurring?
Look for unusually high volumes of GET requests to the listed localization endpoints with many distinct locale-tag values. Rising JVM heap usage followed by OutOfMemoryError events or Keycloak service termination is consistent with this issue.