CVE-2026-2575mediumCWE-409

CVE-2026-2575: medium-severity vulnerability in Red Hat build of Keycloak 26.4

Keycloak: keycloak: denial of service due to excessive samlrequest decompression

Published · Updated

Follow this CVE+ Monitor Red Hat build of Keycloak+ Monitor Red Hat Single Sign-On

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.7%
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Red Hat · Red Hat build of Keycloak 26.4Red Hat · Red Hat build of Keycloak 26.4.10Red Hat · Red Hat Single Sign-On 7.6.13Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9Red Hat · RHEL-8 based Middleware Containers
Related CVEs — Red Hat build of Keycloak 26.4

In the same product, most dangerous first.

CVE-2026-18963CRITICALKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassEPSS 4.7%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.6%CVE-2025-9784HIGHUndertow: undertow madeyoureset http/2 ddos vulnerabilityEPSS 2.3%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.2%CVE-2026-93574MEDIUMIo.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingEPSS 1.4%CVE-2025-12543CRITICALUndertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrfEPSS 1.3%