Keycloak: Schwachstelle ermöglicht Denial of Service

Summary

Product

Vulnerabilities 1

• Medium 5.3
  CVE-2026-2575

  Keycloak: keycloak: denial of service due to excessive samlrequest decompression

  A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE deco…

  Red Hat Red Hat build of Keycloak 26.4 RHEL-8 based Middleware Containers Red Hat Single Sign-On 7.6 for RHEL 7 Wolfi Maven
  Mar 18, 2026

Revision history

1. 2026-03-17 #3

   Referenz(en) aufgenommen: EUVD-2026-12766

2. 2026-03-05 #2

   Neue Updates von Red Hat aufgenommen

3. 2026-02-15 #1

   Initiale Fassung

References

• Red Hat Bugtracker vom 2026-02-15
  https://bugzilla.redhat.com/show_bug.cgi?id=2440149
• RedHat Customer Portal vom 2026-02-15
  https://access.redhat.com/security/cve/cve-2026-2575
• Red Hat Security Advisory RHSA-2026:3947 vom 2026-03-05
  https://access.redhat.com/errata/RHSA-2026:3947
• Red Hat Security Advisory RHSA-2026:3948 vom 2026-03-05
  https://access.redhat.com/errata/RHSA-2026:3948