CVE-2026-9801: Keycloak: keycloak: denial of service via malformed ldap password policy response
A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9801?
The severity of CVE-2026-9801 is classified as medium with a CVSS score of 4.9.
What does CVE-2026-9801 affect?
CVE-2026-9801 affects the Keycloak software, specifically in its handling of LDAP password policies.
How can an attacker exploit CVE-2026-9801?
An attacker with high privileges can exploit CVE-2026-9801 by sending a malformed LDAP password policy response.
What is the risk of CVE-2026-9801?
CVE-2026-9801 presents a risk of denial of service for systems using Keycloak configured with vulnerable LDAP integrations.
How do I mitigate CVE-2026-9801?
To mitigate CVE-2026-9801, ensure that your Keycloak configuration does not allow untrusted LDAP servers and monitor for any malformed responses.