A flaw in Keycloak permits an attacker with high privileges—such as a realm administrator who can configure an LDAP server or an attacker who has compromised an upstream LDAP server—to send a malformed LDAP password‑policy response during a password authentication request. The malformed response triggers an OutOfMemoryError, causing the Keycloak Java Virtual Machine to terminate and leaving all realms on the affected node unavailable. The attack results in a denial of service, affecting only availability and not exposing data or enabling code execution. The weakness is identified as CWE‑1284.

The vulnerability impacts Red Hat Build of Keycloak. No specific product versions are listed in the advisory, so all installations of this build may be affected until further information is released.

The CVSS score of 4.9 indicates a low‑to‑moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, indicating a lower likelihood of widespread exploitation. The attacker must have realm‑administrator privileges or control an LDAP server that Keycloak trusts. Once those conditions are met, the attacker can remotely trigger the OutOfMemoryError by sending the crafted LDAP response. The primary attack vector is a remote LDAP interaction, inferred from the description.