CVE-2026-2575 | BDVDB-2026-320963 Detail
Red HatRed Hat build of Keycloak 26.4
Description#
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact low. Attack vector: network.
Weaknesses#
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
References#
- https://access.redhat.com/errata/RHSA-2026:3947
- https://access.redhat.com/errata/RHSA-2026:3948
- https://access.redhat.com/errata/RHSA-2026:76128
- https://access.redhat.com/errata/RHSA-2026:76129
- https://access.redhat.com/errata/RHSA-2026:76130
- https://access.redhat.com/errata/RHSA-2026:76132
- https://access.redhat.com/errata/RHSA-2026:76134
- https://access.redhat.com/security/cve/CVE-2026-2575
- https://bugzilla.redhat.com/show_bug.cgi?id=2440149
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.