What’s Vulnerable › Vulnerabilities

CVE-2026-2575: Keycloak: keycloak: denial of service due to excessive samlrequest decompression

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-18 · updated 2026-10-06
• Weakness: CWE-409

Description

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

Affected products

• Red Hat build of Keycloak 26.4: from 26.4 before 26.4.10 — fixed in 26.4.10

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4.10. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:3947
• https://access.redhat.com/errata/RHSA-2026:3948
• https://access.redhat.com/errata/RHSA-2026:76128
• https://access.redhat.com/errata/RHSA-2026:76129
• https://access.redhat.com/errata/RHSA-2026:76130
• https://access.redhat.com/errata/RHSA-2026:76132
• https://access.redhat.com/errata/RHSA-2026:76134
• https://access.redhat.com/security/cve/CVE-2026-2575
• https://bugzilla.redhat.com/show_bug.cgi?id=2440149

Get alerted when CVE-2026-2575 or the next vulnerability affects your stack