Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-16100 Details

Description

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/errata/RHSA-2026:50848 [email protected]Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:50849 [email protected]Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-16100 [email protected]Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2501730 [email protected]Issue TrackingVendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-770Allocation of Resources Without Limits or Throttling[email protected]
CWE-770Allocation of Resources Without Limits or ThrottlingCISA-ADP

Affected Products

ProductVersions
redhat build of keycloak
>= 26.6, < 26.6.5

CPE

  • cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-16100
NVD Published Date:
Aug 5, 2026
NVD Last Modified:
Aug 31, 2026
Source:
[email protected]
CVE-2026-16100 Details - Not Deferred