CVE-2026-110932

A flaw in the theme resource endpoint of Keycloak , an open-source identity and access management solution, allows for unauthenticated persistent disk exhaustion . The root cause is the server's failure to validate theme names before using them as keys for an on-disk gzip cache . An unauthenticat...

CVE-2026-110932 Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache

A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many...