MEDIUM5.3
GHSA-xv6h-r36f-3gp5
Keycloak: Denial of Service due to excessive SAMLRequest decompression
Quick fix
GHSA-xv6h-r36f-3gp5 — org.keycloak:keycloak-saml-adapter-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>26.5.4</version> for org.keycloak:keycloak-saml-adapter-coreDetails
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.keycloak:keycloak-saml-adapter-core
Introduced in:
0Fixed in: 26.5.4Fix
# pom.xml: bump <version>26.5.4</version> for org.keycloak:keycloak-saml-adapter-coreMaven/org.keycloak:keycloak-saml-core
Introduced in:
0Fixed in: 26.5.4Fix
# pom.xml: bump <version>26.5.4</version> for org.keycloak:keycloak-saml-coreMaven/org.keycloak:keycloak-services
Introduced in:
0Fixed in: 26.5.4Fix
# pom.xml: bump <version>26.5.4</version> for org.keycloak:keycloak-servicesReferences
- https://nvd.nist.gov/vuln/detail/CVE-2026-2575[ADVISORY]
- https://github.com/keycloak/keycloak/issues/46372[WEB]
- https://github.com/keycloak/keycloak/commit/4f90ef67f698dfb45df0d2f4981271a7c8b47f04[WEB]
- https://access.redhat.com/errata/RHSA-2026:3947[WEB]
- https://access.redhat.com/errata/RHSA-2026:3948[WEB]
- https://access.redhat.com/security/cve/CVE-2026-2575[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2440149[WEB]
- https://github.com/keycloak/keycloak[PACKAGE]