Vulnerability-Lookup

JVNDB-2026-026852

Vulnerability from jvndb - Published: 2026-08-05 10:11 - Updated:2026-08-05 10:11

Summary

Multiple Vulnerabilities in Hitachi Ops Center Common Services

Details

Multiple vulnerabilities exist in Hitachi Ops Center Common Services. CVE-2025-10939, CVE-2025-11537, CVE-2025-11538, CVE-2025-12110, CVE-2025-13467, CVE-2025-13881, CVE-2025-14082, CVE-2025-14083, CVE-2025-14777, CVE-2025-66560, CVE-2026-0707, CVE-2026-0871, CVE-2026-0976, CVE-2026-1035, CVE-2026-1190, CVE-2026-2092, CVE-2026-2575, CVE-2026-2673, CVE-2026-3009, CVE-2026-3121, CVE-2026-3429, CVE-2026-3872, CVE-2026-3911, CVE-2026-4282, CVE-2026-4325, CVE-2026-4634, CVE-2026-22745, CVE-2026-22748, CVE-2026-25854, CVE-2026-40972, CVE-2026-40975

References

Type

URL

	CVE	https://www.cve.org/CVERecord?id=CVE-2025-10939
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-11537
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-11538
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-12110
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-13467
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-13881
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-14082
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-14083
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-14777
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-66560
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-0707
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-0871
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-0976
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-1035
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-1190
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-2092
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-22745
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-22748
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-2575
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-25854
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-2673
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3009
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3121
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3429
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3872
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3911
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-40972
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-40975
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-4282
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-4325
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-4634

Impacted products

Vendor

Product

Hitachi, Ltd

Hitachi Ops Center Common Services

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026852.html",
  "dc:date": "2026-08-05T10:11+09:00",
  "dcterms:issued": "2026-08-05T10:11+09:00",
  "dcterms:modified": "2026-08-05T10:11+09:00",
  "description": "Multiple vulnerabilities exist in Hitachi Ops Center Common Services.\r\n\r\nCVE-2025-10939, CVE-2025-11537, CVE-2025-11538, CVE-2025-12110, CVE-2025-13467, CVE-2025-13881, CVE-2025-14082, CVE-2025-14083, CVE-2025-14777, CVE-2025-66560, CVE-2026-0707, CVE-2026-0871, CVE-2026-0976, CVE-2026-1035, CVE-2026-1190, CVE-2026-2092, CVE-2026-2575, CVE-2026-2673, CVE-2026-3009, CVE-2026-3121, CVE-2026-3429, CVE-2026-3872, CVE-2026-3911, CVE-2026-4282, CVE-2026-4325, CVE-2026-4634, CVE-2026-22745, CVE-2026-22748, CVE-2026-25854, CVE-2026-40972, CVE-2026-40975",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026852.html",
  "sec:cpe": {
    "#text": "cpe:/a:hitachi:ops_center_common_services",
    "@product": "Hitachi Ops Center Common Services",
    "@vendor": "Hitachi, Ltd",
    "@version": "2.2"
  },
  "sec:identifier": "JVNDB-2026-026852",
  "sec:references": [
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-10939",
      "@id": "CVE-2025-10939",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-11537",
      "@id": "CVE-2025-11537",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-11538",
      "@id": "CVE-2025-11538",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-12110",
      "@id": "CVE-2025-12110",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-13467",
      "@id": "CVE-2025-13467",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-13881",
      "@id": "CVE-2025-13881",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-14082",
      "@id": "CVE-2025-14082",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-14083",
      "@id": "CVE-2025-14083",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-14777",
      "@id": "CVE-2025-14777",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-66560",
      "@id": "CVE-2025-66560",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-0707",
      "@id": "CVE-2026-0707",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-0871",
      "@id": "CVE-2026-0871",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-0976",
      "@id": "CVE-2026-0976",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-1035",
      "@id": "CVE-2026-1035",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-1190",
      "@id": "CVE-2026-1190",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-2092",
      "@id": "CVE-2026-2092",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-22745",
      "@id": "CVE-2026-22745",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-22748",
      "@id": "CVE-2026-22748",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-2575",
      "@id": "CVE-2026-2575",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-25854",
      "@id": "CVE-2026-25854",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-2673",
      "@id": "CVE-2026-2673",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3009",
      "@id": "CVE-2026-3009",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3121",
      "@id": "CVE-2026-3121",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3429",
      "@id": "CVE-2026-3429",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3872",
      "@id": "CVE-2026-3872",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3911",
      "@id": "CVE-2026-3911",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-40972",
      "@id": "CVE-2026-40972",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-40975",
      "@id": "CVE-2026-40975",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-4282",
      "@id": "CVE-2026-4282",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-4325",
      "@id": "CVE-2026-4325",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-4634",
      "@id": "CVE-2026-4634",
      "@source": "CVE"
    }
  ],
  "title": "Multiple Vulnerabilities in Hitachi Ops Center Common Services"
}

CVE-2026-4634 (GCVE-0-2026-4634)

Vulnerability from cvelistv5 – Published: 2026-04-02 12:44 – Updated: 2026-07-15 00:50

Title

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

Summary

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Assigner

redhat

References

7 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:6475	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6476	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6477	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6478	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-4634	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2450250	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

6 products

Vendor	Product	Version
Red Hat	Red Hat build of Keycloak 26.2	Unaffected: 26.2.15-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.2::el9
Red Hat	Red Hat build of Keycloak 26.2	Unaffected: 26.2-18 , < * (rpm) cpe:/a:redhat:build_keycloak:26.2::el9
Red Hat	Red Hat build of Keycloak 26.2.15	cpe:/a:redhat:build_keycloak:26.2::el9
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4.11-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4-14 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4.11	cpe:/a:redhat:build_keycloak:26.4::el9

Date Public

2026-04-02 12:30

Credits

Red Hat would like to thank Evan Hendra (Independent Security Researcher) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4634",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-03T17:22:51.847497Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-03T17:23:00.421Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.2.15-1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.2-18",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.2-18",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.2::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.2.15",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.4.11-1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.4-14",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.4-14",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.4::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.4.11",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-02T12:30:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1050",
                "description": "Excessive Platform Resource Consumption within a Loop",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T00:50:36.563Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-4634"
          },
          {
            "name": "RHBZ#2450250",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450250"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4634.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6476"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6478"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6475"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6477"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:6476: Red Hat build of Keycloak 26.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6478: Red Hat build of Keycloak 26.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6475: Red Hat build of Keycloak 26.2.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6477: Red Hat build of Keycloak 26.4.11"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-23T08:40:02.817Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-02T12:30:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.2.15-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.2-18",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.2-18",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.2::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.2.15",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4.11-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-14",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-14",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.4.11",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Evan Hendra (Independent Security Researcher) for reporting this issue."
        }
      ],
      "datePublic": "2026-04-02T12:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1050",
              "description": "Excessive Platform Resource Consumption within a Loop",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T13:56:53.134Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:6475",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:6475"
        },
        {
          "name": "RHSA-2026:6476",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:6476"
        },
        {
          "name": "RHSA-2026:6477",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:6477"
        },
        {
          "name": "RHSA-2026:6478",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:6478"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-4634"
        },
        {
          "name": "RHBZ#2450250",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450250"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-23T08:40:02.817Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-02T12:30:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-1050: Excessive Platform Resource Consumption within a Loop"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-4634",
    "datePublished": "2026-04-02T12:44:53.424Z",
    "dateReserved": "2026-03-23T08:41:40.650Z",
    "dateUpdated": "2026-07-15T00:50:36.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

JVNDB-2026-026852

CVE-2026-4634 (GCVE-0-2026-4634)

Tags

Sightings

Nomenclature