A flaw in Keycloak permits an unauthenticated remote attacker to trigger repeated TLS 1.2 client‑initiated renegotiation requests, consuming significant CPU resources and rendering the service unavailable. The vulnerability does not affect confidentiality or integrity, but it can be used to cause a temporary loss of availability for any users or clients relying on the Keycloak instance.

The security advisory lists Red Hat build of Keycloak 26.0—including the 26.0.16 revision—and Red Hat build of Keycloak 26.2, including the 26.2.10 revision, as affected products. All other builds not listed remain unaffected.

The CVSS score of 7.5 indicates a moderate‑to‑severe risk, yet the EPSS score is below 1 % and the vulnerability is not currently listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. An attacker only needs the ability to connect to the Keycloak server and initiate TLS renegotiation; no authentication or privileged credentials are required. Once engaged, the repeated renegotiation cycles can exhaust CPU resources, leading to a denial of service that lasts until the server restarts or the workload is mitigated.