CVE-2026-2575: Keycloak: keycloak: denial of service due to excessive samlrequest decompression
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Other sources
Summary: An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending a highly compressed SAMLRequest via the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and process termination.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2575?
CVE-2026-2575 is classified as a denial of service vulnerability that can lead to application-level outages.
How do I fix CVE-2026-2575?
To fix CVE-2026-2575, upgrade your Keycloak version to 26.5.4 or later.
What type of attack does CVE-2026-2575 enable?
CVE-2026-2575 enables an unauthenticated remote attacker to perform a denial of service by sending a highly compressed SAMLRequest.
Which Keycloak components are affected by CVE-2026-2575?
CVE-2026-2575 affects Keycloak services, saml-core, and saml-adapter-core packages.
Is authentication required to exploit CVE-2026-2575?
No, CVE-2026-2575 can be exploited by unauthenticated attackers.