CVE-2026-2575

medium

Published 2026-03-18 · Modified 2026-06-03

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS v4 NEW

—

not yet in upstream

VIR risk

5.3

Description

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

Predictions

Exploit likelihood

63%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression Red Hat statement This MODERATE impact denial of service flaw affects Red Hat Build of Keycloak (RHBK). An unauthenticated remote attacker can exploit this by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server's inability to enforce size limits during DEFLATE…

Description

keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression

Red Hat statement

This MODERATE impact denial of service flaw affects Red Hat Build of Keycloak (RHBK). An unauthenticated remote attacker can exploit this by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server's inability to enforce size limits during DEFLATE decompression leads to an OutOfMemoryError, causing process termination and disrupting service availability. This vulnerability is applicable when Keycloak is configured to use SAML Redirect Binding.

CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Errata / fixed releases

Product	Package	Advisory	Released
Red Hat build of Keycloak 26.4	`rhbk/keycloak-operator-bundle:26.4.10-1`	RHSA-2026:3948	2026-03-05T00:00:00Z
Red Hat build of Keycloak 26.4	`rhbk/keycloak-rhel9:26.4-12`	RHSA-2026:3948	2026-03-05T00:00:00Z
Red Hat build of Keycloak 26.4	`rhbk/keycloak-rhel9-operator:26.4-12`	RHSA-2026:3948	2026-03-05T00:00:00Z
Red Hat build of Keycloak 26.4.10	`rhbk/keycloak-rhel9`	RHSA-2026:3947	2026-03-05T00:00:00Z

Apply commands

bash fix

Apply RHSA-2026:3948 for Red Hat build of Keycloak 26.4

yum update -y rhbk/keycloak-operator-bundle:26
# or:
dnf upgrade -y rhbk/keycloak-operator-bundle:26

Package impact

Ecosystem	Package	Vulnerable	Fixed
Maven	org.keycloak:keycloak-saml-adapter-core	`<26.5.4`	`26.5.4`
Maven	org.keycloak:keycloak-saml-core	`<26.5.4`	`26.5.4`
Maven	org.keycloak:keycloak-services	`<26.5.4`	`26.5.4`

Application impact

Vendor	Product	Versions	Fixed
redhat	build_of_keycloak	`{"startIncluding":"26.4","endExcluding":"26.4.10"}`	`26.4.10`

References

CWEs

CWE-409

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.