REDHAT-BUG-2508307: High severity Keycloak Keycloak SAML Redirect Binding vulnerability
A memory leak flaw was found in Keycloaks SAML Redirect Binding. The implementation uses custom Deflater and Inflater instances to handle DEFLATE compression and decompression for SAML artifacts. These Java classes allocate native memory via zlib that is not managed by the standard Java heap. The code fails to call the end method on these instances, which is required to explicitly release the native resources. An unauthenticated remote attacker can trigger this leak by sending specially crafted, malformed SAML Redirect requests to the Keycloak SAML endpoint. Because the native memory is not reclaimed by the Java garbage collector, repeated requests will cause the process resident set size (RSS) to grow until the operating system terminates the process due to memory exhaustion. Successful exploitation results in a complete denial of service for the Keycloak instance.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
No authentication is required. A remote attacker can target the Keycloak SAML endpoint with specially crafted malformed SAML Redirect requests.
Which deployments are realistically exposed?
Keycloak instances whose SAML endpoint can receive remote requests are exposed to this attack path. The available information does not specify any configuration prerequisite beyond handling SAML Redirect requests.
How can operators recognize an attack or resulting impact?
The Keycloak process RSS will increase as malformed requests are repeatedly processed because native zlib memory is not reclaimed by Java garbage collection. Continued growth can exhaust memory and cause the operating system to terminate the process.