5.3
Medium
CVE-2026-2575 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-12 | 26.4-12 |
| Red Hat build of Keycloak 26.4.10 | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat Single Sign-On 7.6.13 | Versions not published | |
| RHEL-8 based Middleware Containers 7.6 | earliest → < 7.6-85 | 7.6-85 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 7 | Versions not published |
Other CVEs of Red Hat build of Keycloak 26.4
The 116 CVEs of Red Hat build of Keycloak 26.4 →
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Medium
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Medium
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Medium
CVE-2026-97847
Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
7.1
High