CVE-2026-110932
Last modified
CVE-2026-110932 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache.
Description
A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Build of Keycloak | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-110932?
How severe is CVE-2026-110932?
How do I fix CVE-2026-110932?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110925Rejected reason: CVE-2026-110925 has been marked as a duplic…
- CVE-2026-110926Rejected reason: CVE-2026-110926 has been marked as a duplic…
- CVE-2026-110927Rejected reason: CVE-2026-110927 has been marked as a duplic…
- CVE-2026-11093Inappropriate implementation in Printing in Google Chrome pr…6.5
- CVE-2026-110930Codex Desktop for Windows does not correctly check quotation…
- CVE-2026-110931A flaw was found in the SAML 1.1 assertion parser of Keycloa…7.5
- CVE-2026-110933Uncaught exception vulnerability in Samsung Open Source Vyon…4.4
- CVE-2026-110934Improper validation of array index vulnerability in Samsung …4.4
- CVE-2026-110935The PFI plugin framework deployment routine does not validat…8.4
- CVE-2026-110936A vulnerability has been identified in Siemens Software Cent…6.7
- CVE-2026-110938In Eclipse OpenJ9 versions up to 0.63.0, the JITServer compo…8.7
- CVE-2026-11094Use after free in Codecs in Google Chrome on Windows prior t…9.6
Are you affected by CVE-2026-110932?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST