CVE-2026-18212highCWE-401

CVE-2026-18212: high-severity vulnerability in Red Hat build of Keycloak 26.4

Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

Published

Follow this CVE+ Monitor Red Hat build of Keycloak+ Monitor Red Hat Single Sign-On

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.7%
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Red Hat · Red Hat build of Keycloak 26.4Red Hat · Red Hat build of Keycloak 26.4.16Red Hat · Red Hat build of Keycloak 26.6Red Hat · Red Hat build of Keycloak 26.6.7Red Hat · Red Hat Data Grid 8Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Single Sign-On 7
Related CVEs — Red Hat build of Keycloak 26.4

In the same product, most dangerous first.

CVE-2026-18963CRITICALKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassEPSS 4.7%CVE-2026-7307HIGHKeycloak: keycloak: denial of service via specially crafted saml inputEPSS 0.9%CVE-2026-74909HIGHKeycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segmentsEPSS 0.8%CVE-2026-7507HIGHOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverEPSS 0.8%CVE-2026-17615HIGHResteasy-core: resteasy sourceprovider remote unauthenticated file readEPSS 0.8%CVE-2026-79651HIGHKeycloak-services: keycloak-services: unauthenticated dos via unbounded locale cachingEPSS 0.8%