CVE-2026-16100

CVE-2026-16100 describes a flaw in Keycloak where, when metrics are enabled, raw error messages from failed account operations are recorded as Prometheus metric labels. Because these messages may include user-supplied input (e.g., nonexistent client IDs), an authenticated user can generate an eno...

kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion

A denial of service vulnerability was found in the Kubernetes API server. This flaw allows a remote attacker to send repeated, crafted HTTP requests to exhaust available memory and cause a crash...