GHSA-xv6h-r36f-3gp5
Keycloak: Denial of Service due to excessive SAMLRequest decompression
At a glance
- Published
- Updated
- CVE
- CVE-2026-2575
- Aliases
- BIT-keycloak-2026-2575
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-saml-adapter-core | introduced 0, fixed 26.5.4 |
| Maven · org.keycloak:keycloak-saml-core | introduced 0, fixed 26.5.4 |
| Maven · org.keycloak:keycloak-services | introduced 0, fixed 26.5.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-2575 ADVISORY
- https://github.com/keycloak/keycloak/issues/46372 WEB
- https://github.com/keycloak/keycloak/commit/4f90ef67f698dfb45df0d2f4981271a7c8b47f04 WEB
- https://access.redhat.com/errata/RHSA-2026:3947 WEB
- https://access.redhat.com/errata/RHSA-2026:3948 WEB
- https://access.redhat.com/errata/RHSA-2026:76128 WEB
- https://access.redhat.com/errata/RHSA-2026:76129 WEB
- https://access.redhat.com/errata/RHSA-2026:76130 WEB
- https://access.redhat.com/errata/RHSA-2026:76132 WEB
- https://access.redhat.com/errata/RHSA-2026:76134 WEB
- https://access.redhat.com/security/cve/CVE-2026-2575 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2440149 WEB
- https://github.com/keycloak/keycloak PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |