5.3Medium
CVE-2026-2575Keycloak: keycloak: denial of service due to excessive samlrequest decompression
Description
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Weakness (CWE):
CWE-409
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| build keycloak | 26.4 | — | |
| redhat | build of keycloak | 26.4 – < 26.4.10 | |
| Red Hat | Red Hat build of Keycloak 26.4 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.4.10 | — | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6.13 | — | |
| Red Hat | RHEL-8 based Middleware Containers | all versions | |
| red hat single sign on | 7.6 | — | |
| rhosemc | 1.0 | — |
References and patches
- RHSA-2026:3947 vendor-advisoryVendor Advisory
- RHSA-2026:3948 vendor-advisoryVendor Advisory
- RHSA-2026:76128 vendor-advisory
- RHSA-2026:76129 vendor-advisory
- RHSA-2026:76130 vendor-advisory
- RHSA-2026:76132 vendor-advisory
- RHSA-2026:76134 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-2575 vdb-entryVendor Advisory
- RHBZ#2440149 issue-trackingIssue TrackingVendor Advisory
CPE matches (NVD) (1)
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*≥ 26.4 < 26.4.10