CVE-2026-4634: Keycloak: Application-Level DoS via Scope Processing
(updated )
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
References
- access.redhat.com/errata/RHSA-2026:6475
- access.redhat.com/errata/RHSA-2026:6476
- access.redhat.com/errata/RHSA-2026:6477
- access.redhat.com/errata/RHSA-2026:6478
- access.redhat.com/security/cve/CVE-2026-4634
- bugzilla.redhat.com/show_bug.cgi?id=2450250
- github.com/advisories/GHSA-h4wv-g838-66g3
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/commit/b455ee4f28abb6f2120aff72fd179589cc5267a0
- github.com/keycloak/keycloak/issues/47716
- nvd.nist.gov/vuln/detail/CVE-2026-4634
Code Behaviors & Features
Detect and mitigate CVE-2026-4634 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →