CVE-2026-9801

A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.

• CWE-1284

• https://access.redhat.com/errata/RHSA-2026:25097
• https://access.redhat.com/errata/RHSA-2026:25098
• https://access.redhat.com/errata/RHSA-2026:30049
• https://access.redhat.com/errata/RHSA-2026:30050
• https://access.redhat.com/security/cve/CVE-2026-9801Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2482473Issue Tracking, Vendor Advisory

Published

May 28, 2026

Last Modified

Jun 26, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9794A flaw was found in Keycloak. A remote, unauthenticated atta…5.3
• CVE-2026-9795A flaw was found in Keycloak's Fine-Grained Admin Permission…7.3
• CVE-2026-9796A flaw was found in Keycloak. An authenticated administrator…6.5
• CVE-2026-9798A flaw was found in Keycloak, an open-source identity and ac…4.3
• CVE-2026-9799A flaw was found in org.keycloak.authorization. An authentic…4.6
• CVE-2026-9800A flaw was found in Keycloak Policy Enforcer. This vulnerabi…8.1
• CVE-2026-9802A flaw was found in Keycloak. When revokeRefreshToken=true i…6.8
• CVE-2026-9803A flaw was found in Keycloak's ClientRegistrationAuth compon…5.3
• CVE-2026-9804A flaw was found in KubeVirt's virt-exportserver component. …7.7
• CVE-2026-9806A stored cross-site scripting (XSS) vulnerability exists in …6.3
• CVE-2026-9807GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-9808An authorization bypass vulnerability exists in the Mautic 7…7.1