Keycloak: keycloak: denial of service due to excessive samlrequest decompression
Published Mar 18, 2026
5.3
MEDIUMCVSS 3.1
EPSS 0.66%
Description
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Affected products
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| Red Hat | Red Hat Single Sign-On 7 | affected |
|
- ≥ 26.4 · < 26.4.10
No data.
Red Hat build of Keycloak 26.4
rhbk/keycloak-operator-bundle:26.4.10-1
Fixed · RHSA-2026:3948
Red Hat build of Keycloak 26.4
rhbk/keycloak-rhel9-operator:26.4-12
Fixed · RHSA-2026:3948
Red Hat build of Keycloak 26.4
rhbk/keycloak-rhel9:26.4-12
Fixed · RHSA-2026:3948
Red Hat build of Keycloak 26.4.10
rhbk/keycloak-rhel9
Fixed · RHSA-2026:3947
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-operator-bundle:26.4.10-1 | Fixed | RHSA-2026:3948 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9-operator:26.4-12 | Fixed | RHSA-2026:3948 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9:26.4-12 | Fixed | RHSA-2026:3948 |
| Red Hat build of Keycloak 26.4.10 | rhbk/keycloak-rhel9 | Fixed | RHSA-2026:3947 |
No package ranges for this CVE.
Remediation
Vendor solution
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat statement
This MODERATE impact denial of service flaw affects Red Hat Build of Keycloak (RHBK). An unauthenticated remote attacker can exploit this by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server's inability to enforce size limits during DEFLATE decompression leads to an OutOfMemoryError, causing process termination and disrupting service availability. This vulnerability is applicable when Keycloak is configured to use SAML Redirect Binding.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Mar 18, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
Score over time
Mar–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 0.66% (0.00663) | 49.90th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.50% (0.00502) | 38.76th | v5 (v2026.06.15) |
| Mar 18, 2026 | 0.02% (0.00023) | 5.72th | v4 (v2025.03.14) |
References (9)
- https://access.redhat.com/errata/RHSA-2026:3947 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:3948 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-2575 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2440149 issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory
- https://github.com/advisories/GHSA-xv6h-r36f-3gp5 Advisory
- https://github.com/keycloak/keycloak/commit/4f90ef67f698dfb45df0d2f4981271a7c8b47f04
- https://github.com/keycloak/keycloak/issues/46372
- https://nvd.nist.gov/vuln/detail/CVE-2026-2575
- https://www.cve.org/CVERecord?id=CVE-2026-2575
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:3947 | vendor-advisoryx_refsource_REDHATVendor Advisory | |
| https://access.redhat.com/errata/RHSA-2026:3948 | vendor-advisoryx_refsource_REDHATVendor Advisory | |
| https://access.redhat.com/security/cve/CVE-2026-2575 | vdb-entryx_refsource_REDHATVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2440149 | issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory | |
| https://github.com/advisories/GHSA-xv6h-r36f-3gp5 | Advisory | |
| https://github.com/keycloak/keycloak/commit/4f90ef67f698dfb45df0d2f4981271a7c8b47f04 | ||
| https://github.com/keycloak/keycloak/issues/46372 | ||
| https://nvd.nist.gov/vuln/detail/CVE-2026-2575 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-2575 |
Change history (0)
No recorded changes yet.