CVE-2026-4634
High · 7.5CVSS
7.5
EPSS
0.9%
Published
Apr 2, 2026
CISA due date
—
The record
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-85977 A flaw was found in libtirpc. CWE-1050
- CVE-2026-94287 A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19… CWE-1050
- CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried… CWE-1050
- CVE-2026-52681 Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid… CWE-1050
- CVE-2026-71488 league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. CWE-1050
- CVE-2026-48779 ws is an open source WebSocket client and server for Node.js. CWE-1050
- CVE-2026-44390 NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling… CWE-1050
- CVE-2026-41292 NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of… CWE-1050