EUVD-2026-80828
GHSA-wgrv-cjmx-4vfw
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Impact | All available signals point to a genuine but bounded (availability-only) network DoS. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: an unauthenticated attacker sends repeated malformed SAML requests to the network-facing SAML Redirect Binding endpoint, and CWE-401 (missing release of native zlib memory) causes cumulative native-memory exhaustion. Unlike many DoS CVEs where a network vector is over-claimed, here AV:N and PR:N are well-justified - SAML endpoints are typically internet- or intranet-exposed and accept unauthenticated protocol messages by design. C:N/I:N/A:H is honest: there is no data exposure or integrity impact, only crash/unavailability. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation; exploitation status is 'no public exploit identified at time of analysis.' Net: a real, patch-worthy issue for any organization exposing Keycloak/RH SSO SAML, but its priority is moderated by the DoS-only impact and absence of exploitation evidence - prioritize for exposed IdPs, standard patch cadence for internal-only deployments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Native memory exhaustion in Keycloak's SAML Redirect Binding allows an unauthenticated remote attacker to degrade or halt the service by repeatedly sending malformed SAML requests that leak zlib-allocated native memory. Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the Red Hat JBoss EAP Expansion Pack are all affected because they embed the same SAML handling code. There is no public exploit identified at time of analysis, and the assessed impact is availability-only (CVSS 7.5, C:N/I:N/A:H), consistent with a genuine but bounded denial-of-service condition; vendor errata (RHSA-2026:68276 through RHSA-2026:68280) address the flaw.
RemediationAI
Patch availability is confirmed per vendor advisory: Red Hat has published errata RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278, and RHSA-2026:68280 (https://access.redhat.com/errata/RHSA-2026:68276, https://access.redhat.com/errata/RHSA-2026:68277, https://access.redhat.com/errata/RHSA-2026:68278, https://access.redhat.com/errata/RHSA-2026:68280), so administrators should identify the erratum matching their product stream (Red Hat Build of Keycloak, RH-SSO 7, Data Grid 8, or JBoss EAP Expansion Pack) and apply the updated build; the advisory at https://access.redhat.com/security/cve/CVE-2026-18212 should be consulted for the exact fixed versions. Until patching completes, the most effective compensating control is rate limiting or temporarily restricting access to the SAML Redirect Binding endpoints (the /realms/{realm}/protocol/saml endpoints and the SAML broker/IDP callback paths) at a reverse proxy or WAF, accepting the trade-off that aggressive thresholds may throttle legitimate service-provider traffic and that some SPs cannot simply switch to HTTP-POST binding without reconfiguration on both sides. Because the leak is in native memory, heap dashboards will not reveal it: monitor process RSS/native memory and container memory-limit counters, and set aggressive OOM/restart policies so a leaking instance recycles before it starves the pod, with the trade-off of brief availability gaps during restart. Restarting the affected JVM periodically reclaims leaked native memory and is a temporary mitigation only, not a fix, since the leak resumes immediately on the next malformed request.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SAML's HTTP-Redirect binding requires the SAMLRequest/SAMLResponse message to be DEFLATE-compressed and base64-encoded, so Keycloak ships custom compression and decompression helpers that wrap native zlib rather than relying solely on the JVM's managed heap. This CVE is rooted in CWE-401 (Missing Release of Memory after Effective Lifetime): the helpers allocate native zlib buffers/resources for each inflate/deflate operation but never free them, so the leak accumulates in native (off-heap) memory. Because the allocations live outside the Java heap, they are invisible to standard heap monitoring and are not reclaimed by garbage collection, meaning process RSS - and ultimately the container or host memory limit - is what fails. The vulnerable code path is reachable pre-authentication through SAML Redirect Binding parsing, and the CVSS vector AV:N/AC:L/PR:N/UI:N confirms it is a remotely triggerable, unauthenticated, low-complexity issue with high availability impact and no confidentiality or integrity impact; malformed SAML inputs are described as the specific trigger that exercises the leaking decompression path.
Know when Red Hat Build Of Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.
Executive ViewAI
Keycloak, together with the Red Hat products that embed its SAML code path - Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the Red Hat JBoss EAP Expansion Pack - is exposed to a memory-exhaustion condition that can slow or stop the identity service entirely. Because these platforms serve as the authentication hub for large numbers of internal and customer-facing applications, a sustained outage would block logins and cascading downstream services rather than expose data. Leadership should treat this as a business-continuity and availability risk to the identity tier, with no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include disabling the SAML Redirect Binding where it is not required, restricting SAML endpoint network exposure to trusted identity providers and service providers only, applying reverse-proxy or WAF request-size limits and per-source rate limiting, capping connection and memory limits on affected nodes, enabling native-memory and GC monitoring with automated alerting and health-based restarts, and running affected instances in a redundant, horizontally scaled configuration so a single degraded node does not interrupt authentication.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Exploit-DB