CVE-2026-16100 Red Hat CVE debrief

Who should care

Administrators and users of Keycloak instances with metrics enabled should be aware of this vulnerability and take steps to mitigate it. Authenticated users with low privileges can potentially exploit this flaw to cause a denial-of-service condition. Operators, platform administrators, and security teams should review affected deployments and plan for remediation or compensating controls as needed.

Technical summary

A flaw in Keycloak's user-event metrics recording can lead to a denial-of-service condition. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Authenticated users can create a massive number of unique metric entries by including user-supplied input in error messages, potentially exhausting system memory and causing the service to crash or become unavailable. This issue requires review of user-supplied input validation and system memory usage monitoring.

Defensive priority

Authenticated users with low privileges can cause a denial-of-service condition by creating a large number of unique metric entries, potentially exhausting system memory.

Recommended defensive actions

• Review and limit user-supplied input in error messages to prevent excessive metric entries.
• Monitor system memory usage and implement alerts for potential denial-of-service conditions.
• Consider implementing rate limiting on user-generated metric entries.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record indicates that a flaw in Keycloak's user-event metrics recording can lead to a denial-of-service condition. Authenticated users can create a massive number of unique metric entries by including user-supplied input in error messages, potentially exhausting system memory. The NVD entry is currently 6.5 MEDIUM. Evidence limits suggest that defenders should verify system memory usage and review user-supplied input validation.

Official resources