CVE-2026-16100

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the user-event metrics recording process. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Since these error messages can incorporate user-supplied input, such as nonexistent client IDs, an authenticated user can generate an excessive number of unique metric entries. This leads to unbounded metric cardinality, which can exhaust system memory and cause the service to crash or become unavailable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.