CVE-2026-2575: Red Hat Keycloak Denial of Service via SAMLRequest decompression

CVE-2026-2575 · Severity: medium · CVSS 5.3 · Published 2026-03-18

Keycloak, a popular identity and access management service, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send a specially crafted, highly compressed login request that causes the server to run out of memory and crash. This can disrupt user authentication services and prevent legitimate users from accessing protected applications.

Technologies: org.keycloak:keycloak-saml-core (Maven), org.keycloak:keycloak-services (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-2575 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2575 being exploited in the wild.
How severe is CVE-2026-2575?
Medium severity, with a CVSS score of 5.3, published 18 March 2026.
Which products and versions are affected?
org.keycloak:keycloak-saml-adapter-core (Maven) < 26.5.4, ECOSYSTEM:introduced=0,fixed=26.5.4; org.keycloak:keycloak-saml-core (Maven) < 26.5.4, ECOSYSTEM:introduced=0,fixed=26.5.4; org.keycloak:keycloak-services (Maven) < 26.5.4, ECOSYSTEM:introduced=0,fixed=26.5.4.
Is there a fix for CVE-2026-2575?
Yes. org.keycloak:keycloak-saml-adapter-core (Maven): upgrade to 26.5.4 or later; org.keycloak:keycloak-saml-core (Maven): upgrade to 26.5.4 or later; org.keycloak:keycloak-services (Maven): upgrade to 26.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2575 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-2575?
Check whether you run org.keycloak:keycloak-saml-adapter-core (Maven), org.keycloak:keycloak-saml-core (Maven) or org.keycloak:keycloak-services (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-saml-adapter-core (Maven): upgrade to 26.5.4 or later
    # set org.keycloak:keycloak-saml-adapter-core to 26.5.4 in your pom.xml or build.gradle
  • org.keycloak:keycloak-saml-core (Maven): upgrade to 26.5.4 or later
    # set org.keycloak:keycloak-saml-core to 26.5.4 in your pom.xml or build.gradle
  • org.keycloak:keycloak-services (Maven): upgrade to 26.5.4 or later
    # set org.keycloak:keycloak-services to 26.5.4 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Keycloak's handling of SAML Redirect Bindings due to improper handling of highly compressed data (CWE-409). The server fails to enforce size limits during the DEFLATE decompression of a SAMLRequest. An unauthenticated remote attacker can exploit this by sending a 'zip bomb' style request, leading to an OutOfMemoryError (OOM) and subsequent process termination. This disrupts service availability without requiring prior authentication or user interaction. The issue is addressed in Red Hat build of Keycloak version 26.4.10.

Affected products

  • Red Hat Keycloak from 26.4 up to (excluding) 26.4.10

Identifiers

  • CVE-2026-2575
  • GHSA-xv6h-r36f-3gp5

Timeline

  • 2026-02-16: disclosed: Initial report in Red Hat Bugzilla
  • 2026-03-05: patched: Red Hat released security advisories RHSA-2026:3947 and RHSA-2026:3948
  • 2026-03-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.