Keycloak DoS via max SAMLRequest over SAML Redirect Binding
CVE-2026-2575 Published on March 18, 2026
Keycloak: keycloak: denial of service due to excessive samlrequest decompression
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Vulnerability Analysis
CVE-2026-2575 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is a Data Amplification Vulnerability?
The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
CVE-2026-2575 has been classified to as a Data Amplification vulnerability or weakness.
Products Associated with CVE-2026-2575
Want to know whenever a new CVE is published for Red Hat Build Keycloak? stack.watch will email you.
Affected Versions
Red Hat build of Keycloak 26.4:- Version 26.4.10-1 and below * is unaffected.
- Version 26.4-12 and below * is unaffected.
- Version 26.4-12 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.