Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-16100 EUVD-2026-53384GHSA-xj3w-m54w-h7p9

Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

Published Aug 5, 2026 · Updated Aug 31, 2026 · Assigned by redhat

Description

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Keycloak 26.6 — —
Red Hat Red Hat build of Keycloak 26.6.5 — —
Red Hat Red Hat Data Grid 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Red Hat Red Hat Single Sign-On 7 — —

Advisories 1

References