CVE-2026-18212: Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-16
Weakness: CWE-401

Description

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.

Affected products

Red Hat build of Keycloak 26.4: all versions — fixed in 26.4-26, 26.4.16-2, 26.6-20, 26.6.7-3
Red Hat Data Grid 8: all versions
Red Hat Single Sign-On 7: all versions

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4-26, 26.4.16-2, 26.6-20, 26.6.7-3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-18212 or the next vulnerability affects your stack