PT-2026-26027 · Red Hat · Keycloak

Osidb Bzimport · Published 2026-03-18 · Updated 2026-06-03 · CVE-2026-2575

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak where an unauthenticated remote attacker can trigger an application-level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server does not enforce size limits during DEFLATE decompression, resulting in an OutOfMemoryError (OOM) and process termination. This allows an attacker to disrupt the availability of the service. The vulnerability involves exploiting the decompression process with a manipulated SAMLRequest sent via the SAML Redirect Binding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2026-2575

GHSA-XV6H-R36F-3GP5

Affected Products

Keycloak

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-2575 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2440149 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:3948 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xv6h-r36f-3gp5 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-2575 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:3947 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/4f90ef67f698dfb45df0d2f4981271a7c8b47f04 · Note
• https://github.com/keycloak/keycloak/issues/46372 · Note
• https://t.me/cveNotify/165849 · Telegram Post
• https://twitter.com/CVEarity/status/2034177802648621339 · Twitter Post
• https://twitter.com/CVEnew/status/2034136412367257829 · Twitter Post