A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator
    configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an
    upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy
    response during a password authentication request, the attacker can trigger an OutOfMemoryError. This
    causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all
    realms on the affected node. (CVE-2026-9801)

ID	Name	Product	Family	Type	Severity
462255	Echo: org.keycloak:keycloak-ldap-federation: security update to 26.6.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462255	Echo: org.keycloak:keycloak-ldap-federation: security update to 26.6.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
444280	SCA: security update for org.keycloak:keycloak-ldap-federation (GHSA-f6r7-6w34-x2gp)	Tenable Cloud Security	SCA Checks	Local	medium
444280	SCA: security update for org.keycloak:keycloak-ldap-federation (GHSA-f6r7-6w34-x2gp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-9801

medium

Tenable Plugins

medium

medium

medium

medium