Riskcovery

CVE-2026-2575

Keycloak: keycloak: denial of service due to excessive samlrequest decompression

State
Published
Severity
5.3 Medium
Published
Mar 18, 2026
Updated
Oct 6, 2026
Reserved
Feb 16, 2026

Read the record on cve.org

Description

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lredhat

Weaknesses

  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

Affected Products

ProductVersions
Red Hat build of Keycloak 26.4Red Hat
  • 26.4.10-1 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat
  • 26.4-12 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat
  • 26.4-12 and laterNot affected
Red Hat build of Keycloak 26.4.10Red Hat
    Red Hat Single Sign-On 7.6.13Red Hat
      Red Hat Single Sign-On 7.6 for RHEL 7Red Hat
      • 0:18.0.20-1.redhat_00001.1.el7sso and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 8Red Hat
      • 0:18.0.20-1.redhat_00001.1.el8sso and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 9Red Hat
      • 0:18.0.20-1.redhat_00001.1.el9sso and laterNot affected
      RHEL-8 based Middleware ContainersRed Hat
      • 7.6-85 and laterNot affected

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.