EUVD-2026-12766
GHSA-xv6h-r36f-3gp5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates this is a network-exploitable, low-complexity attack requiring no privileges or user interaction, with limited scope and only availability impact. While CVSS yields 5.3 (medium), the real-world risk is substantial because: (1) the attack is fully automatable and unauthenticated, (2) no proof-of-concept complexity barriers exist given the straightforward nature of DEFLATE bombs, (3) Keycloak is a critical authentication/authorization service whose downtime has cascading effects on dependent applications, and (4) the ENISA EUVD tracking and multiple Red Hat advisories (RHSA-2026:3947 and RHSA-2026:3948) indicate this was treated as a priority fix requiring coordinated release. The vulnerability should be prioritized for patching despite the moderate CVSS score, as availability of authentication infrastructure is operationally critical. |
| Exploit ScenarioDerived | An attacker crafts a malicious SAMLRequest with a payload compressed using DEFLATE that is small in wire size (e.g., a few kilobytes) but expands to gigabytes when decompressed. The attacker sends this request to the Keycloak SAML Redirect Binding endpoint (typically /auth/realms/{realm}/protocol/saml) without authentication. Keycloak's SAML processor receives the request, decompresses it without size validation, triggering rapid memory exhaustion and OutOfMemoryError, which crashes the JVM process and causes service unavailability until manual restart. Because the attack vector is network-based and requires no special privileges, any internet-facing Keycloak instance is vulnerable; a single request can achieve denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
Unauthenticated remote attackers can exhaust memory in Red Hat Build of Keycloak 26.4 and 26.4.10 by sending highly compressed SAML requests that bypass decompression size limits, triggering denial of service. The vulnerability affects SAML Redirect Binding implementations that fail to enforce resource constraints during DEFLATE decompression, allowing attackers to crash the application with OutOfMemoryError conditions. No patch is currently available.
Earlier versions of this analysis (1)
A denial-of-service vulnerability exists in Red Hat Keycloak where an unauthenticated remote attacker can send a highly compressed SAMLRequest via the SAML Redirect Binding without triggering server-side decompression size limits, causing an OutOfMemoryError that crashes the process. Red Hat build of Keycloak versions 26.4 through 26.4.10 are affected, and the attack requires no authentication, user interaction, or special configuration. While the CVSS score of 5.3 reflects low to moderate severity with only availability impact, the attack is trivially executable over the network with low complexity.
RemediationAI
Immediately upgrade Red Hat build of Keycloak to a patched version beyond 26.4.10-1, following the guidance in Red Hat advisories RHSA-2026:3947 and RHSA-2026:3948 available at https://access.redhat.com/errata/. As a temporary mitigation prior to patching, implement a reverse proxy or WAF rule that enforces maximum size limits on SAML requests before they reach Keycloak (set a reasonable upper bound such as 1 MB for SAMLRequest payloads to block decompression bombs), restrict SAML endpoint access to known IdP IP ranges if possible, and configure JVM memory monitoring with alerts for OutOfMemoryError conditions. Additionally, ensure heap memory limits are appropriately sized and monitored, and consider implementing request rate limiting on SAML endpoints to reduce the frequency of potential attacks during the patch window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits the SAML 2.0 Redirect Binding protocol, which uses DEFLATE compression for XML payloads. Keycloak fails to enforce decompression bomb protections (CWE-409: Improper Restriction of Rendered UI Layers or Frames, which generalizes to unbounded resource consumption during decompression). When processing incoming SAMLRequest messages, the server decompresses the payload without size validation, allowing an attacker to send a small compressed payload that expands to extremely large sizes in memory, exhausting heap allocation and triggering OutOfMemoryError. The affected CPE identifiers include cpe:2.3:a:red_hat:red_hat_build_of_keycloak_26.4:*:*:*:*:*:*:*:* and specifically patch versions 26.4-12 and 26.4.10-1, confirming the issue spans multiple minor releases.
Know when Red Hat Build Of Keycloak 26 4 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Blast Radius
ecosystem impact- 5 maven packages depend on org.keycloak:keycloak-saml-adapter-core (4 direct, 1 indirect)
- 33 maven packages depend on org.keycloak:keycloak-saml-core (8 direct, 25 indirect)
- 56 maven packages depend on org.keycloak:keycloak-services (27 direct, 29 indirect)
Ecosystem-wide dependent count for version 26.5.4 and other introduced versions.
Executive ViewAI
Organizations using A flaw should be aware of moderate risk from CVE-2026-2575 rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Keycloak Remote Attack Vulnerabilities
View all 2Keycloak contains an authentication bypass vulnerability in its SAML broker functionality that allows remote attackers w
Keycloak's SAML broker endpoint contains a validation flaw that allows attackers with a valid signed SAML assertion to i
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to im
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a
Same technique Denial Of Service
View allVendor StatusVendor
Debian
Bug #1088287| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Exploit-DB