ZeroDay Findings
Sign inSign up

Findings

CVE-2026-2575

A flaw was found in Keycloak.

Published Mar 18, 2026 · updated Oct 6, 2026 · redhat build of keycloak

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 18, 2026 · NIST NVD

    Detected

    A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the avai

  2. Oct 6, 2026 · NIST NVD

    Updated

    A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the avai

Affected

  • cpe redhat/build of keycloakversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-2575

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-2575

    A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to

    nvd.nist.gov

References

CVE-2026-2575 · ZeroDay Findings