REDHAT-BUG-2523345: High severity Keycloak Keycloak vulnerability
A flaw was found in Keycloak where the theme localization endpoints (/resources/master/common/{locale} and /admin/{realm}/console/messages.json) fail to validate or limit the locale tags provided in the request. Each unique locale tag results in a new entry being created in an unbounded in-memory cache within the theme message system. An unauthenticated remote attacker can exploit this by sending a high volume of HTTP GET requests containing unique BCP 47 locale tags. Because the cache is permanent and has no size limit, this leads to continuous heap memory consumption. Successful exploitation allows an attacker to exhaust the JVM heap memory, leading to an OutOfMemoryError and causing the Keycloak service to terminate, resulting in a complete denial of service.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need a Keycloak account or other authentication to exploit this issue?
No. The affected localization endpoints can be targeted by an unauthenticated remote attacker using HTTP GET requests.
What request pattern is associated with exploitation attempts?
Attempts involve sending a high volume of GET requests to /resources/master/common/{locale} or /admin/{realm}/console/messages.json with unique BCP 47 locale tags. Each distinct tag creates a persistent in-memory cache entry, increasing JVM heap consumption.