CVE-2026-2575BIT-keycloak-2026-2575GHSA-xv6h-r36f-3gp5
org.keycloak:keycloak-saml-adapter-core: Keycloak: Denial of Service due to excessive SAMLRequest decompression
Red Hat org.keycloak:keycloak-saml-adapter-coremavenIdentity & access
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.87%Chance of exploitation activity in the next 30 days, higher than 58% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 26.5.4org.keycloak:keycloak-saml-adapter-core, mavenGitHub
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-saml-adapter-core</artifactId><version>26.5.4</version></dependency> - 26.5.4org.keycloak:keycloak-saml-core, mavenGitHub
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-saml-core</artifactId><version>26.5.4</version></dependency> - 26.5.4org.keycloak:keycloak-services, mavenGitHub
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-services</artifactId><version>26.5.4</version></dependency> - 26.5.4org.keycloak:keycloak-saml-adapter-core, MavenOSV
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-saml-adapter-core</artifactId><version>26.5.4</version></dependency> - 26.5.4org.keycloak:keycloak-saml-core, MavenOSV
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-saml-core</artifactId><version>26.5.4</version></dependency> - 26.5.4org.keycloak:keycloak-services, MavenOSV
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-services</artifactId><version>26.5.4</version></dependency>
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Text from CVE List
Affected versions 162
- org.keycloak:keycloak-saml-adapter-core, maven< 26.5.4GitHub
- org.keycloak:keycloak-saml-core, maven< 26.5.4GitHub
- org.keycloak:keycloak-services, maven< 26.5.4GitHub
- Red Hat build of Keycloak 26.4unaffected: 26.4.10-1 and laterCVE List
- Red Hat build of Keycloak 26.4unaffected: 26.4-12 and laterCVE List
- Red Hat Single Sign-On 7.6 for RHEL 7unaffected: 0:18.0.20-1.redhat_00001.1.el7sso and laterCVE List
- Red Hat Single Sign-On 7.6 for RHEL 8unaffected: 0:18.0.20-1.redhat_00001.1.el8sso and laterCVE List
- Red Hat Single Sign-On 7.6 for RHEL 9unaffected: 0:18.0.20-1.redhat_00001.1.el9sso and laterCVE List
- RHEL-8 based Middleware Containersunaffected: 7.6-85 and laterCVE List
- org.keycloak:keycloak-saml-adapter-core, Mavenfrom first release, fixed in 26.5.4OSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.6.0.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.6.1.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.7.0.CR1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.7.0.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.8.0.Alpha1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.8.0.CR1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.8.0.CR2OSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.8.0.CR3OSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.8.0.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.8.1.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.9.0.CR1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.9.0.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.9.1.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.9.2.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.9.3.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.9.4.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.9.5.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.9.7.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven1.9.8.FinalOSV
- org.keycloak:keycloak-saml-adapter-core, Maven10.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven10.0.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven10.0.2OSV
- org.keycloak:keycloak-saml-adapter-core, Maven11.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven11.0.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven11.0.2OSV
- org.keycloak:keycloak-saml-adapter-core, Maven11.0.3OSV
- org.keycloak:keycloak-saml-adapter-core, Maven12.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven12.0.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven12.0.2OSV
- org.keycloak:keycloak-saml-adapter-core, Maven12.0.3OSV
- org.keycloak:keycloak-saml-adapter-core, Maven12.0.4OSV
- org.keycloak:keycloak-saml-adapter-core, Maven13.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven13.0.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven14.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven15.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven15.0.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven15.0.2OSV
- org.keycloak:keycloak-saml-adapter-core, Maven15.1.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven15.1.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven16.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven16.1.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven16.1.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven17.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven17.0.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven18.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven18.0.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven18.0.2OSV
- org.keycloak:keycloak-saml-adapter-core, Maven19.0.0OSV
- org.keycloak:keycloak-saml-adapter-core, Maven19.0.1OSV
- org.keycloak:keycloak-saml-adapter-core, Maven19.0.2OSV
- org.keycloak:keycloak-saml-core, Mavenfrom first release, fixed in 26.5.4OSV
- org.keycloak:keycloak-saml-core, Maven1.1.0.Beta1OSV
- org.keycloak:keycloak-saml-core, Maven1.1.0.Beta2OSV
- org.keycloak:keycloak-saml-core, Maven1.1.0.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.1.1.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.2.0.Beta1OSV
- org.keycloak:keycloak-saml-core, Maven1.2.0.CR1OSV
- org.keycloak:keycloak-saml-core, Maven1.2.0.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.3.0.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.3.1.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.4.0.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.5.0-FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.5.0.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.5.1.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.6.0.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.6.1.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.7.0.CR1OSV
- org.keycloak:keycloak-saml-core, Maven1.7.0.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.8.0.Alpha1OSV
- org.keycloak:keycloak-saml-core, Maven1.8.0.CR1OSV
- org.keycloak:keycloak-saml-core, Maven1.8.0.CR2OSV
- org.keycloak:keycloak-saml-core, Maven1.8.0.CR3OSV
- org.keycloak:keycloak-saml-core, Maven1.8.0.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.8.1.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.9.0.CR1OSV
- org.keycloak:keycloak-saml-core, Maven1.9.0.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.9.1.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.9.2.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.9.3.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.9.4.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.9.5.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.9.7.FinalOSV
- org.keycloak:keycloak-saml-core, Maven1.9.8.FinalOSV
- org.keycloak:keycloak-saml-core, Maven10.0.0OSV
- org.keycloak:keycloak-saml-core, Maven10.0.1OSV
- org.keycloak:keycloak-saml-core, Maven10.0.2OSV
- org.keycloak:keycloak-saml-core, Maven11.0.0OSV
- org.keycloak:keycloak-saml-core, Maven11.0.1OSV
- org.keycloak:keycloak-saml-core, Maven11.0.2OSV
- org.keycloak:keycloak-saml-core, Maven11.0.3OSV
- org.keycloak:keycloak-saml-core, Maven12.0.0OSV
- org.keycloak:keycloak-saml-core, Maven12.0.1OSV
- org.keycloak:keycloak-saml-core, Maven12.0.2OSV
- org.keycloak:keycloak-saml-core, Maven12.0.3OSV
- org.keycloak:keycloak-saml-core, Maven12.0.4OSV
- org.keycloak:keycloak-saml-core, Maven13.0.0OSV
- org.keycloak:keycloak-saml-core, Maven13.0.1OSV
- org.keycloak:keycloak-saml-core, Maven14.0.0OSV
- org.keycloak:keycloak-saml-core, Maven15.0.0OSV
- org.keycloak:keycloak-saml-core, Maven15.0.1OSV
- org.keycloak:keycloak-saml-core, Maven15.0.2OSV
- org.keycloak:keycloak-services, Mavenfrom first release, fixed in 26.5.4OSV
- org.keycloak:keycloak-services, Maven1.0-alpha-1OSV
- org.keycloak:keycloak-services, Maven1.0-alpha-1-12062013OSV
- org.keycloak:keycloak-services, Maven1.0-alpha-2OSV
- org.keycloak:keycloak-services, Maven1.0-alpha-3OSV
- org.keycloak:keycloak-services, Maven1.0-alpha-4OSV
- org.keycloak:keycloak-services, Maven1.0-beta-1OSV
- org.keycloak:keycloak-services, Maven1.0-beta-1-20150521OSV
- org.keycloak:keycloak-services, Maven1.0-beta-1-20150523OSV
- org.keycloak:keycloak-services, Maven1.0-beta-2OSV
- org.keycloak:keycloak-services, Maven1.0-beta-3OSV
- org.keycloak:keycloak-services, Maven1.0-beta-4OSV
- org.keycloak:keycloak-services, Maven1.0-finalOSV
- org.keycloak:keycloak-services, Maven1.0-rc-1OSV
- org.keycloak:keycloak-services, Maven1.0-rc-2OSV
- org.keycloak:keycloak-services, Maven1.0.1.FinalOSV
- org.keycloak:keycloak-services, Maven1.0.2.FinalOSV
- org.keycloak:keycloak-services, Maven1.0.3.FinalOSV
- org.keycloak:keycloak-services, Maven1.0.4.FinalOSV
- org.keycloak:keycloak-services, Maven1.0.5.FinalOSV
- org.keycloak:keycloak-services, Maven1.1.0.Beta1OSV
- org.keycloak:keycloak-services, Maven1.1.0.Beta2OSV
- org.keycloak:keycloak-services, Maven1.1.0.FinalOSV
- org.keycloak:keycloak-services, Maven1.1.1.FinalOSV
- org.keycloak:keycloak-services, Maven1.2.0.Beta1OSV
- org.keycloak:keycloak-services, Maven1.2.0.CR1OSV
- org.keycloak:keycloak-services, Maven1.2.0.FinalOSV
- org.keycloak:keycloak-services, Maven1.3.0.FinalOSV
- org.keycloak:keycloak-services, Maven1.3.1.FinalOSV
- org.keycloak:keycloak-services, Maven1.4.0.FinalOSV
- org.keycloak:keycloak-services, Maven1.5.0-FinalOSV
- org.keycloak:keycloak-services, Maven1.5.0.FinalOSV
- org.keycloak:keycloak-services, Maven1.5.1.FinalOSV
- org.keycloak:keycloak-services, Maven1.6.0.FinalOSV
- org.keycloak:keycloak-services, Maven1.6.1.FinalOSV
- org.keycloak:keycloak-services, Maven1.7.0.CR1OSV
- org.keycloak:keycloak-services, Maven1.7.0.FinalOSV
- org.keycloak:keycloak-services, Maven1.8.0.Alpha1OSV
- org.keycloak:keycloak-services, Maven1.8.0.CR1OSV
- org.keycloak:keycloak-services, Maven1.8.0.CR2OSV
- org.keycloak:keycloak-services, Maven1.8.0.CR3OSV
- org.keycloak:keycloak-services, Maven1.8.0.FinalOSV
- org.keycloak:keycloak-services, Maven1.8.1.FinalOSV
- org.keycloak:keycloak-services, Maven1.9.0.CR1OSV
- org.keycloak:keycloak-services, Maven1.9.0.FinalOSV
- org.keycloak:keycloak-services, Maven1.9.1.FinalOSV
- org.keycloak:keycloak-services, Maven1.9.2.FinalOSV
- org.keycloak:keycloak-services, Maven1.9.3.FinalOSV
- org.keycloak:keycloak-services, Maven1.9.4.FinalOSV
- org.keycloak:keycloak-services, Maven1.9.5.FinalOSV
- org.keycloak:keycloak-services, Maven1.9.7.FinalOSV
References 13
- github.com/keycloak/keycloak/commit/4f90ef67f698dfb45df0d2f4981271a7c8b47f04Fixvia GitHub
- access.redhat.com/errata/RHSA-2026:3947Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:3948Advisoryvia CVE List
- access.redhat.com/security/cve/CVE-2026-2575Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76132Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76134Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76129Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76130Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76128Advisoryvia CVE List
- github.com/advisories/GHSA-xv6h-r36f-3gp5Advisoryvia GitHub
- nvd.nist.gov/vuln/detail/CVE-2026-2575Referencevia GitHub
- bugzilla.redhat.com/show_bug.cgi?id=2440149Referencevia CVE List
- github.com/keycloak/keycloak/issues/46372Referencevia GitHub