CVE-2026-110932

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An issue exists in the theme resource endpoint where the server does not validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can send numerous requests containing unique, fabricated theme names, resulting in persistent disk space exhaustion. This condition persists after server restarts and leads to service disruptions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.