CVE-2026-9803: Keycloak has an Out-of-bounds Read
(updated )
A flaw was found in Keycloak’s ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed ‘Authorization: Bearer’ header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service.
References
- access.redhat.com/errata/RHSA-2026:25097
- access.redhat.com/errata/RHSA-2026:25098
- access.redhat.com/errata/RHSA-2026:30049
- access.redhat.com/errata/RHSA-2026:30050
- access.redhat.com/security/cve/CVE-2026-9803
- bugzilla.redhat.com/show_bug.cgi?id=2482465
- github.com/advisories/GHSA-cpf7-j4cf-vqx4
- github.com/keycloak/keycloak/commit/2b8692499e907e6205be0bd9c8a4da5d46f6ca30
- github.com/keycloak/keycloak/commit/3fc06909cc93eb5c4739a712fa350de625812e04
- github.com/keycloak/keycloak/commit/ef06df91d344c7e99fcb82987ef6adb854f30789
- github.com/keycloak/keycloak/issues/49433
- github.com/keycloak/keycloak/pull/49500
- github.com/keycloak/keycloak/pull/49617
- github.com/keycloak/keycloak/pull/49618
- nvd.nist.gov/vuln/detail/CVE-2026-9803
Code Behaviors & Features
Detect and mitigate CVE-2026-9803 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →