Executive brief
Keycloak, a popular identity and access management service, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send a specially crafted, highly compressed login request that causes the server to run out of memory and crash. This can disrupt user authentication services and prevent legitimate users from accessing protected applications.
Technical details
A vulnerability exists in Keycloak's handling of SAML Redirect Bindings due to improper handling of highly compressed data (CWE-409). The server fails to enforce size limits during the DEFLATE decompression of a SAMLRequest. An unauthenticated remote attacker can exploit this by sending a 'zip bomb' style request, leading to an OutOfMemoryError (OOM) and subsequent process termination. This disrupts service availability without requiring prior authentication or user interaction. The issue is addressed in Red Hat build of Keycloak version 26.4.10.
Affected products
- Red Hat Keycloak from 26.4 up to (excluding) 26.4.10
Timeline
- 2026-02-16: disclosed: Initial report in Red Hat Bugzilla
- 2026-03-05: patched: Red Hat released security advisories RHSA-2026:3947 and RHSA-2026:3948
- 2026-03-18: advisory: NVD publication date