Keycloak Client Registration Component Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Keycloak's ClientRegistrationAuth component. This issue allows remote, unauthenticated attackers to disrupt service by sending specially crafted POST requests with malformed 'Authorization: Bearer' headers to client registration endpoints. The vulnerability causes an ArrayIndexOutOfBoundsException, leading the server to return an HTTP 500 error and temporarily disrupting the affected service.

Impact

Exploitation of this vulnerability causes a temporary denial-of-service condition on the Keycloak instance, as the server crashes or restarts due to the unhandled exception caused by the malformed authorization header.