VulnSocial

CVE-2026-79651Disclosure

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-400

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-09-17); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-17: 1Mentions · 2026-09-22: 1Mentions · 2026-09-30: 1PoC Mentioned / Linked · 2026-09-22: 1Patch / Workaround · 2026-09-30: 1Technical Details · 2026-09-17: 1Technical Details · 2026-09-30: 109-1709-2209-30
Signal classification3 categories
Disclosure
133.3%
PoC
133.3%
Patch
133.3%
Classification over time
DateTotalLabels
2026-09-171
Disclosure1
2026-09-221
PoC1
2026-09-301
Patch1
Full discourse3 posts
  • Cloud-IAM@cloud_iam_com
    Disclosure

    CVE-2026-79651 (7.5): The theme localization endpoints accept arbitrary locale tags in request and stores them permanently in memory without limits. Sending a sufficient number of tags could cause the service to run out of memory and crash.

    Post summary

    CVE-2026-79651 is disclosed with a CVSS score of 7.5, detailing that theme localization endpoints accept unlimited locale tags, potentially causing out‑of‑memory crashes when abused.

    1002039
    215 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-79651 (CVSS 7.5) - Keycloak DoS vulnerability allows unauthenticated attackers to crash servers via unbounded locale tag cache. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/57NjhBxdKe

    Post summary

    The tweet announces a high-severity Keycloak DoS vulnerability and explicitly urges immediate patching. It provides technical vulnerability details but no PoC, named exploit tool, or active exploitation evidence.

    0001036
    143 followersView on X
  • psytester@psytester1
    PoC

    Keycloak CVE-2026-79651 is easy to exploit. The PoC took ~2 hours. 150 parallel requests to all known {realms} and iterate {locale} like zz-x-{loopcounter} on endpoint /resources/{realm}/admin/{locale} The message bundle for 'admin' has the highest impact with response of > 360kb

    Post summary

    The tweet announces a proof‑of‑concept for Keycloak CVE‑2026‑79651, demonstrating exploitation via parallel requests to an admin endpoint and noting a large response size.

    00001106
    105 followersView on X

Explore more

Back to dashboard