Executive brief
Keycloak is an open-source identity and access management (IAM) system used by organizations to manage user authentication and authorization. A vulnerability in its SAML authentication feature fails to properly release memory during compression operations, allowing attackers to send malicious authentication requests that exhaust system memory and crash the service, disrupting access for legitimate users.
Technical details
A flaw exists in Keycloak's SAML Redirect Binding implementation where custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this vulnerability by sending repeated malformed SAML requests to trigger the memory leak. This leads to progressive native memory exhaustion and eventual denial of service through service crash. The attack requires no authentication and is network-reachable. Patches are available from Red Hat and Keycloak maintainers.
Affected products
- Keycloak Keycloak <UNKNOWN>
Timeline
- 2026-09-16: disclosed
- other: CVE-2026-18212 assigned